Alle Security Headers für Caddy konfigurieren

# Caddyfile — Alle Security-Header zentral
# Generiert aus Wolf-Agents Web Security Guide, Kapitel 00-16

ihre-domain.de {
    header {
        # --- Kap 01: Content Security Policy ---
        # ANPASSEN: Ersetzen Sie die Domains durch Ihre eigenen
        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; object-src 'none'; worker-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; report-uri /csp-report; report-to csp-endpoint"

        # --- Kap 02: HTTP Strict Transport Security ---
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

        # --- Kap 04: Permissions Policy ---
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), idle-detection=(), serial=(), browsing-topics=(), unload=()"

        # --- Kap 05: Clickjacking-Schutz ---
        X-Frame-Options "SAMEORIGIN"

        # --- Kap 06: Referrer Policy ---
        Referrer-Policy "strict-origin-when-cross-origin"

        # --- Kap 07: MIME-Sniffing-Schutz ---
        X-Content-Type-Options "nosniff"

        # --- Kap 08: Cross-Origin Isolation ---
        Cross-Origin-Resource-Policy "same-origin"
        Cross-Origin-Opener-Policy "same-origin"
        Cross-Origin-Embedder-Policy "credentialless"

        # --- Kap 14: Reporting Endpoints ---
        # ANPASSEN: Ersetzen Sie die URL durch Ihren Reporting-Endpoint
        Reporting-Endpoints `csp-endpoint="https://ihre-domain.de/csp-report"`

        # --- Kap 16: Origin Agent Cluster ---
        Origin-Agent-Cluster "?1"

        # Server-Signatur entfernen
        -Server
        -X-Powered-By
    }
}