Improve security config

servers/traefik/additional/middleware.yml

@@ -0,0 +1,27 @@
+http:
+  middlewares:
+    default:
+      chain:
+        middlewares:
+          - security-headers
+          - hsts
+          - compress
+    compress:
+      compress: true
+    hsts:
+      headers: 
+        stsIncludeSubdomains: false
+        stsPreload: true
+        stsSeconds: 31536000
+        isDevelopment: false
+        forceSTSHeader: true
+    security-headers:
+      headers: 
+        contentTypeNosniff: true
+        referrerPolicy: "no-referrer-when-downgrade"
+        frameDeny: true
+        customResponseHeaders:
+          Cross-Origin-Resource-Policy: same-origin
+          Cross-Origin-Opener-Policy: same-origin
+          Cross-Origin-Embedded-Policy: require-corp
+

servers/traefik/additional/tls.yml

@@ -0,0 +1,18 @@
+tls:
+  options:
+    # To use with the label "traefik.http.routers.myrouter.tls.options=modern@file"
+    modern:
+      minVersion: "VersionTLS13"                          # Minimum TLS Version
+      sniStrict: true                                     # Strict SNI Checking
+    
+    # To use with the label "traefik.http.routers.myrouter.tls.options=intermediate@file"
+    default :
+      cipherSuites:
+        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
+        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
+      minVersion: "VersionTLS12"
+      sniStrict: true