# Remove the old X-Frame-Options header

proxy_hide_header X-Frame-Options;

# Add a Content-Security Policy header to allow embeds from your url

add_header Content-Security-Policy "frame-ancestors 'self' your url;";