Updates exempes/caddy2/Caddyfile to SSL Grade A+

examples/caddy2/Caddyfile

@@ -27,13 +27,17 @@ matrix.DOMAIN.tld {
   }
 
   header {
-          Access-Control-Allow-Origin *
-          Strict-Transport-Security "mag=age=31536000;"
+        # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        # Enable cross-site filter (XSS) and tell browser to block detected attacks
+        X-XSS-Protection "1; mode=block"
+        # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
+        X-Content-Type-Options "nosniff"
+        # Disallow the site to be rendered within a frame (clickjacking protection)
         X-Frame-Options "DENY"
+        # X-Robots-Tag
+        X-Robots-Tag "noindex, noarchive, nofollow"
                                                                                                                                                                                                                       167,9         79%
-          Strict-Transport-Security "mag=age=31536000;"
-          X-Frame-Options "DENY"
-          X-XSS-Protection "1; mode=block"
   }
 
   # Cache
@@ -78,11 +82,11 @@ matrix.DOMAIN.tld {
   }
 }
 
-:8448 {
+matrix.DOMAIN.tld:8448 {
     handle {
         encode zstd gzip
 
-        	reverse_proxy localhost:8448 {
+        reverse_proxy 127.0.0.1:8048 {
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
                header_up X-Forwarded-TlsProto {tls_protocol}
@@ -96,6 +100,19 @@ dimension.DOMAIN.tld {
 
       tls {$CADDY_TLS}
 
+      header {
+         	# Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
+        	Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        	# Enable cross-site filter (XSS) and tell browser to block detected attacks
+        	X-XSS-Protection "1; mode=block"
+        	# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
+        	X-Content-Type-Options "nosniff"
+        	# Disallow the site to be rendered within a frame (clickjacking protection)
+        	X-Frame-Options "DENY"
+        	# X-Robots-Tag
+        	X-Robots-Tag "noindex, noarchive, nofollow"
+  	}
+
     	handle {
         	encode zstd gzip
 
@@ -113,6 +130,19 @@ element.DOMAIN.tld {
 
     tls {$CADDY_TLS}
 
+ 	header {
+         	# Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
+        	Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        	# Enable cross-site filter (XSS) and tell browser to block detected attacks
+        	X-XSS-Protection "1; mode=block"
+        	# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
+        	X-Content-Type-Options "nosniff"
+        	# Disallow the site to be rendered within a frame (clickjacking protection)
+        	X-Frame-Options "DENY"
+        	# X-Robots-Tag
+        	X-Robots-Tag "noindex, noarchive, nofollow"
+  	}
+
         handle {
               encode zstd gzip