SWAG optional security headers not passed on to nextcloud container

[wmutschl]

I am running both swag and nextcloud (with mariadb and redis) containers from linuxserver.io without any issues. My docker-compose file is available here.

Now after reading

Further discussion on optional SWAG headers

What you’re asking for would not be simple one liners due to the many possible scenarios. That’s why googling and researching them is recommended. As a general rule, if you’re using SWAG to host a public website, like a company website and/or reverse proxy company nextcloud, etc. then turn all of those on for extra security. But if you’re running a home lab where everything is behind something like Authelia and not publicly accessible, you don’t really need those. With HSTS, once you turn it …

I decided to turn all of the optional headers on. However, when I uncomment in ssl.conf

add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;

and restart swag and nextcloud, I get the following warning in the nextcloud admin panel:

If instead I leave the lines uncommented, I don’t get the warnings. Isn’t this counter-intuitive?