# Default Security Headers configuration generated by RapidKit
security_headers:
  enabled: {{ enabled_by_default | tojson }}
  strict_transport_security:
    enabled: {{ strict_transport_security_defaults.get('enabled', True) | tojson }}
    max_age: {{ strict_transport_security_defaults.get('max_age', 63072000) | tojson }}
    include_subdomains: {{ strict_transport_security_defaults.get('include_subdomains', True) | tojson }}
    preload: {{ strict_transport_security_defaults.get('preload', True) | tojson }}
  content_security_policy: {{ security_headers_defaults.get('content_security_policy') | tojson }}
  content_security_policy_report_only: {{ security_headers_defaults.get('content_security_policy_report_only', False) | tojson }}
  referrer_policy: {{ security_headers_defaults.get('referrer_policy', 'strict-origin-when-cross-origin') | tojson }}
  x_frame_options: {{ security_headers_defaults.get('x_frame_options', 'DENY') | tojson }}
  x_content_type_options: {{ security_headers_defaults.get('x_content_type_options', 'nosniff') | tojson }}
  x_xss_protection: {{ security_headers_defaults.get('x_xss_protection', False) | tojson }}
  cross_origin_embedder_policy: {{ security_headers_defaults.get('cross_origin_embedder_policy') | tojson }}
  cross_origin_opener_policy: {{ security_headers_defaults.get('cross_origin_opener_policy') | tojson }}
  cross_origin_resource_policy: {{ security_headers_defaults.get('cross_origin_resource_policy') | tojson }}
  permissions_policy: {{ permissions_policy_defaults | tojson(indent=2) }}
  expect_ct: {{ security_headers_defaults.get('expect_ct') | tojson }}
  x_dns_prefetch_control: {{ security_headers_defaults.get('x_dns_prefetch_control', 'off') | tojson }}
  x_download_options: {{ security_headers_defaults.get('x_download_options', 'noopen') | tojson }}
  additional_headers: {{ additional_headers_defaults | tojson(indent=2) }}
