# Drop response headers that the proxy must control instead of the upstream.
# nginx's `proxy_hide_header` is array-replacement-inherited (just like
# `add_header`), so this partial MUST be included in every location block
# rather than set once at server level — otherwise child overrides wipe
# the parent strips.
#
# - Strict-Transport-Security: rendered by the proxy when TLS is enabled;
#   over plaintext (onion) transport it must never leak from the upstream
#   (RFC 6797), so the strip is unconditional.
# - Deprecated security headers (X-Frame-Options & friends): superseded
#   by CSP, rendered from each role's meta/csp.yml via build_csp_header.
proxy_hide_header Strict-Transport-Security;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;
proxy_hide_header X-Download-Options;
proxy_hide_header X-Permitted-Cross-Domain-Policies;
proxy_hide_header X-Powered-By;