How to secure the self-hosted installation?

[arladmin]

Don't know why, but i'm unable to find any information on how to properly secure my iframely self-hosted installation.

Namely:

1. How to allow certain domains to be able to call the APIs (/iframely, /oembed, /debug) ?
2. Where to configure the api_key parameter?

[iparamonau]

The code in this repository assumes that you will put it behind a reverse proxy such as NGINX. This way, securing of the endpoints is out of our scope as you can do it in your reverse proxy.

api_key parameter is a feature of the Iframely cloud, you don't need it for self-hosting.