Add custom CSP page

content/docs/features/gitlab-integration.mdx

@@ -32,8 +32,12 @@ Inside GitButler, navigate to the project settings by clicking on the small cog
 
 <ImageSection className="mx-auto" src="/gitlab/configure-gitbutler.png" />
 
+### Custom GitLab Instances
+
 You may also provide a different Instance URL if you are using a self-hosted GitLab instance.
 
+Note that if you use a custom GitLab instance, you will likely need to configure a custom CSP (Content Security Policy) to allow GitButler to connect to it. You can find more information on how to do that in the [Custom Content Security Policy (CSP)](/troubleshooting/custom-csp) section of the documentation.
+
 ## Usage
 
 You will now have a "Submit for Review" button on each branch which you can use to create a Merge Request.

content/docs/features/virtual-branches/commits.mdx

@@ -41,6 +41,10 @@ If you use your own key for OpenAI or Anthropic, you can choose which model you
 
 If you don't want to send your diff to another server, you can also use Ollama, which is a local LLM server. With Ollama, you can run nearly any open source large language model ([Llama 3](https://www.ollama.com/library/llama3), [Phi 3](https://www.ollama.com/library/phi3), [Mistral](https://www.ollama.com/library/mistral), [Gemma](https://www.ollama.com/library/gemma), etc) entirely locally.
 
+
+Note that if you choose to configure a self-hosted Ollama server, you will likely need to add a custom CSP (Content Security Policy) to allow GitButler to connect to it. 
+You can find more information on how to do that in the [Custom Content Security Policy (CSP)](/troubleshooting/custom-csp) section of the documentation.
+
 With all of these models, you can also customize the prompt if you want something more specific. In the "Custom AI prompts" section, you can add new prompts and select which one you want to use per project. This is useful for following certain formats or generating messages in other languages, etc.
 
 <ImageSection

content/docs/troubleshooting/custom-csp.mdx

@@ -0,0 +1,64 @@
+---
+title: Custom Content Security Policy (CSP)
+---
+
+import { Tab, Tabs } from 'fumadocs-ui/components/tabs';
+
+By default GitButler uses a strict Content Security Policy (CSP) to protect against various attacks, such as cross-site scripting (XSS) and data injection attacks. This policy restricts the sources from which content can be loaded, as well as the hosts the application can connect to, ensuring that only trusted sources are allowed.
+
+However, there are some cases where you may need to customize the CSP to allow certain features or integrations. Some examples include:
+- Self-hosted GitHub Enterprise instances
+- Self-hosted GitLab instances
+- Self-hosted Ollama instances
+
+In those cases you are likely to observe an error message that looks something like this:
+
+```
+Refused to connect to https://<YOURDOMAIN>.<TLD>/api/v4/projects/9/merge_requests because it does not appear in the connect-src directive of the Content Security Policy.
+```
+
+You can resolve this issue by adding your host to the CSP. 
+
+## Adding a Custom CSP
+
+You can add a custom CSP by editing the GitButler configuration file, found at the following location:
+
+<Tabs groupId="platform" items={['macOS', 'Windows', 'Linux']} persist>
+  <Tab value="macOS">
+  ```bash
+  ~/Library/Application\ Support/gitbutler/settings.json
+  ```
+  </Tab>
+  <Tab value="Windows">
+  ```bash
+  C:\Users\[username]\AppData\Roaming\gitbutler\settings.json
+  ```
+  </Tab>
+  <Tab value="Linux">
+  ```bash
+  ~/.config/gitbutler/settings.json
+  ```
+  </Tab>
+</Tabs>
+
+The file is in JSONC format and follows the [following schema](https://github.com/gitbutlerapp/gitbutler/blob/master/crates/but-settings/assets/defaults.jsonc)
+
+In order to add your custom CSP entry, you want to add an `extraCsp` entry to the JSON file. The `extraCsp` entry is an object that contains a `hosts` array, which is where you can add your custom hosts. For example:
+
+```json
+"extraCsp": {
+		"hosts": ["https://subdomain.example.com", "http://another-subdomain.example.com"]
+}
+```
+
+Note that if `extraCsp` is the only entry in the JSON file, you may want to enclose it in a top-level object, like this:
+
+```json
+{
+  "extraCsp": {
+    "hosts": ["https://subdomain.example.com", "http://another-subdomain.example.com"]
+  }
+}
+```
+
+The changes will take effect the next time you start GitButler.