nginx: Sicherheitsheader greifen jetzt wirklich (add_header wird nicht in location vererbt)

nginx.conf

@@ -4,53 +4,41 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    # Gzip for the text assets.
     gzip on;
     gzip_types text/html text/css application/javascript application/json image/svg+xml;
     gzip_min_length 512;
 
-    # Lightweight health endpoint for Coolify / Docker healthcheck.
+    include /etc/nginx/security-headers.conf;
+
     location = /healthz {
         access_log off;
         add_header Content-Type text/plain;
         return 200 "ok\n";
     }
 
-    # Vendor libs + fonts can be cached hard.
     location /vendor/ {
+        include /etc/nginx/security-headers.conf;
         expires 30d;
         add_header Cache-Control "public, immutable";
     }
 
-    # Service worker and manifest must always revalidate.
     location = /sw.js {
+        include /etc/nginx/security-headers.conf;
         add_header Cache-Control "no-cache";
     }
+
     location = /manifest.webmanifest {
+        include /etc/nginx/security-headers.conf;
         default_type application/manifest+json;
         add_header Cache-Control "no-cache";
     }
 
-    # Never cache the app shell, so updates land immediately.
     location = /index.html {
+        include /etc/nginx/security-headers.conf;
         add_header Cache-Control "no-cache";
     }
 
     location / {
         try_files $uri $uri.html $uri/ /index.html;
     }
-
-    # Hardening headers.
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Strict-Transport-Security "max-age=31536000" always;
-    add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), interest-cohort=()" always;
-
-    # Content Security Policy.
-    # connect-src 'none' ist hier das eigentliche Versprechen: der Browser selbst
-    # unterbindet jede fetch/XHR/WebSocket-Verbindung. "Nothing is uploaded" ist damit
-    # nicht nur behauptet, sondern erzwungen. img-src erlaubt https, damit Bilder aus
-    # eingefuegtem Markdown in der Vorschau sichtbar bleiben.
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'none'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'; manifest-src 'self'; worker-src 'self'" always;
 }