http:
  middlewares:
    security-headers:
      headers:
        # HSTS - force browsers to use HTTPS for 1 year, include subdomains
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        # Prevent MIME-type sniffing
        contentTypeNosniff: true
        # Block rendering in iframes from other origins
        frameDeny: true
        # Referrer policy - send origin only on cross-origin requests
        referrerPolicy: "strict-origin-when-cross-origin"
        # Permissions policy - restrict browser features
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
        # Prevent browsers from caching sensitive responses
        browserXssFilter: true
        # Remove server identity header
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""

    # Variant that allows microphone (for VoiceCoach)
    security-headers-allow-mic:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: true
        referrerPolicy: "strict-origin-when-cross-origin"
        permissionsPolicy: "camera=(), microphone=(self), geolocation=(), payment=()"
        browserXssFilter: true
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""

    # BasicAuth for sensitive services (Guacamole)
    solo-basicauth:
      basicAuth:
        users:
          - "glyptic:$2y$05$6AcmRIjMX6YrxY3fACeDhui4ghBGZtjmiPHbzWDb.qZ.8Fdip4GM."
        realm: "Restricted"

    # Variant that allows framing (for Guacamole, Home Assistant embeds)
    security-headers-allow-frames:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: false
        customFrameOptionsValue: "SAMEORIGIN"
        referrerPolicy: "strict-origin-when-cross-origin"
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
        browserXssFilter: true
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""