added hsts middleware for enhanced security

docker-compose.yml

@@ -14,6 +14,10 @@ services:
     labels:
       - traefik.enable=${TRAEFIK_ENABLED}
       - traefik.docker.network=${TRAEFIK_NETWORK}
+      # specify a custom middleware for nextcloud-specific configuration
+      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.permanent=true
+      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.regex="https://(.*)/.well-known/(card|cal)dav"
+      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.replacement="https://$${1}/remote.php/dav/"
       ### Section HTTP
       - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
       # redirect to HTTPS only
@@ -22,16 +26,13 @@ services:
       ### Section HTTPS
       - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
       # configure the exposed service
+      - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=hsts,nextcloud-redirectregex
       - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=Host(`${TRAEFIK_MATCHRULE}`)
       # of course, enable TLS and it's certificate provider
       - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
       - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
       # specify a service so a custom port can be used
       - traefik.http.services.${TRAEFIK_SERVICE}.loadbalancer.server.port=${TRAEFIK_SERVICE_PORT}
-      # specify a custom middleware for nextcloud-specific configuration
-      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.permanent=true
-      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.regex="https://(.*)/.well-known/(card|cal)dav"
-      - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.replace="https://${1}/remote.php/dav/"
     networks:
       - internal
       - traefik