apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gestion-traefik.labels" . | nindent 4 }}
spec:
  headers:
    stsSeconds: 63072000
    stsIncludeSubdomains: true
    stsPreload: true
    frameDeny: true
    contentTypeNosniff: true
    referrerPolicy: "strict-origin-when-cross-origin"
    permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
    customResponseHeaders:
      X-XSS-Protection: "0"
      Content-Security-Policy: >-
        default-src 'self';
        script-src 'self' 'unsafe-inline';
        style-src 'self' 'unsafe-inline';
        img-src 'self' data: blob: https:;
        font-src 'self' data:;
        connect-src 'self' https:;
        frame-ancestors 'self';
      Server: ""