I swear it should be the other way round (it looks to me like Nextcloud
is embedding the code iframe), but disabling CSP on Nextcloud worked and
I saw a comment on the Internet about it so lets give it a try.