How to change CSP (content security policy) of aio to be able to embed nextcloud as iFrame

[yennor]

When I try to embed the default installation of Nextcloud AIO into an iFrame in an other domain, I get a -more or less expected-

an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'

Is there an easy way to change the CSP of nextcloud in the AIO?
Or would be the only way to change to a reverse proxy setup and override the HTTP CSP header in the reverse proxy?

[yennor]

ok, that's embarassing. I've searched everywhere but in the app-store.
Seems there is an app doing that:
https://apps.nextcloud.com/apps/csp_editor