Security Headers for NGINX Proxy Manager

Issue: https://github.com/jc21/nginx-proxy-manager/issues/582

Due to a bug it's impossible to add securityheaders to NGINX Proxy Manager. Use this workaround to fix this issue:

Step 1. Download _hsts.conf Step 2. Create a volume to this file (read-only)

Docker CLI

Volume location depends on Docker image.

Image: jlesage/nginx-proxy-manager

-v /PROXY-PATH/_hsts.conf:/opt/nginx-proxy-manager/templates/_hsts.conf:ro

Image: jc21/nginx-proxy-manager

-v /PROXY-PATH/_hsts.conf:/app/templates/_hsts.conf:ro

Docker Compose

Volume location depends on Docker image.

Image: jlesage/nginx-proxy-manager

volumes:
    -  /PROXY-PATH/_hsts.conf:/opt/nginx-proxy-manager/templates/_hsts.conf:ro

Image:jc21/nginx-proxy-manager

volumes:
    -  /PROXY-PATH/_hsts.conf:/app/templates/_hsts.conf:ro

Step 3.
Go to NGINX Proxy Manager, click Edit and go to the tab SSL. Enable and/or re-enable Force SSL, HSTS Enabled and HSTS Subdomains.

Done!

Note: If you have enabled an Access List not all headers will load. This is not a bug!

Result @ https://securityheaders.com: