Adding reverse-proxy security header snippets to caddy/nginx/haproxy docs

[CmdKratosDev]

Hi everyone,

I wanted to float an idea for a small docs addition before opening a PR — partly because the repo guidelines ask for discussion first, and partly because I want to make sure the framing fits how the team thinks about security docs.

The gap I noticed

The hardening docs cover setting security headers via environment variables at the application layer. That is clearly the right primary path, and I do not want to change that.

What the current reverse-proxy deployment pages (caddy.md, nginx.md, haproxy.md) do not have is:

• A short note for operators who need to set headers at the proxy layer (shared proxy, managed hosting without env var access, multi-app setups)
• A warning that setting headers in both layers produces duplicates — which silently breaks enforcement in some browsers

What I am proposing

A single new section in each of the three files — ## Optional: Security Headers via Reverse Proxy. The section would:

1. Lead with a pointer to hardening.md (env vars = recommended path)
2. State the single-layer rule clearly
3. Provide a verified, copy-paste snippet for the 5 unambiguous headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
4. Handle CSP as a separate, clearly marked optional block with explicit notes that it is more permissive than the app default and needs REPORT_ONLY testing before enforcing

The snippets have been tested locally (curl-verified against a running Open WebUI instance behind each proxy type).

Scope

The env-var path in hardening.md already covers security headers and remains the recommended approach. This is purely a documentation cross-reference: a pointer plus a proxy-layer snippet on the deployment pages, for operators who configure headers at the proxy. No application behavior changes.

The three sections are drafted and curl-tested against a default install. Unless you'd prefer I hold off or adjust the scope, I'll open a small PR with them — happy to refine the framing first.