[tls.options]
    [tls.options.default]
        minVersion = "VersionTLS12"
        cipherSuites = [
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
            "TLS_AES_128_GCM_SHA256",
            "TLS_AES_256_GCM_SHA384",
            "TLS_CHACHA20_POLY1305_SHA256"
        ]
        curvePreferences = [ "CurveP521", "CurveP384" ]
        sniStrict = true

[http.middlewares.secHeaders.headers]
    browserXssFilter = true
    contentTypeNosniff = true
    frameDeny = true
    stsIncludeSubdomains = true
    stsPreload = true
    stsSeconds = 31_536_000
    customFrameOptionsValue = "SAMEORIGIN"