diff --git a/nextcloud/docker-compose.yml b/nextcloud/docker-compose.yml
index 3ae0425..4ff84c6 100644
--- a/nextcloud/docker-compose.yml
+++ b/nextcloud/docker-compose.yml
@@ -54,6 +54,18 @@ services:
       - traefik.http.routers.nextcloud.tls=true
       - traefik.http.routers.nextcloud.tls.certresolver=cloudflare
       - traefik.http.services.nextcloud.loadbalancer.server.port=80
+      - traefik.http.services.nextcloud.loadbalancer.passhostheader=true
+      - traefik.http.routers.nextcloud.middlewares=nextcloud-redirectregex1,nextcloud-redirectregex2,compresstraefik,nextcloud-securityheaders
+      - traefik.http.middlewares.compresstraefik.compress=true
+      - traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.permanent=true
+      - traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.regex=https?://([^/]*)/.well-known/(card|cal)dav
+      - traefik.http.middlewares.nextcloud-redirectregex1.redirectregex.replacement=https://$${1}/remote.php/dav/
+      - traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.permanent=true
+      - traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.regex=https?://([^/]*)(/.well-known[^#]*)
+      - traefik.http.middlewares.nextcloud-redirectregex2.redirectregex.replacement=https://$${1}/index.php$${2}
+      - traefik.http.middlewares.nextcloud-securityheaders.headers.stsSeconds=15552000
+      - traefik.http.middlewares.nextcloud-securityheaders.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.nextcloud-securityheaders.headers.stsPreload=true
       - traefik.docker.network=frontend
     environment:
       - POSTGRES_HOST=nextcloud_db:5432