homelab tinkering 8

2025-07-16 12:43:34 +02:00
parent e277ca8f9b
commit c1d0eb6c1f
1 changed files with 7 additions and 0 deletions
--- a/modules/server/vaultwarden/default.nix
+++ b/modules/server/vaultwarden/default.nix
@@ -31,6 +31,13 @@ in {

    services.caddy.virtualHosts."vault.cnst.dev".extraConfig = ''
      reverse_proxy ${vcfg.ROCKET_ADDRESS}:${toString vcfg.ROCKET_PORT}
+      header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+        Permissions-Policy "geolocation=(), microphone=(), camera=()"
+      }
    '';

    services.vaultwarden = {