I'm not sure if I'm understanding correctly, but I used to use something like this in "Nginx Proxy Manager" before I discovered that Cloudron would do the same job without double the footprint:
proxy_hide_header Upgrade;
proxy_hide_header X-Powered-By;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cache-Control "no-transform" always;
add_header Referrer-Policy no-referrer always;
add_header X-Robots-Tag none;
These days Cloudron app proxy works 99% of the time out of the box (no added security or fiddling) with added bonus of being hidden behind Cloudflare IP protection, but occassionally it does not.
As of late, I've been having great difficulty figuring out how to pass "localhost:port" from my macOS device to Cloudron hosted on my NAS at a separate IP address without triggering browser security that ends up breaking whatever I'm trying to view through the reverse proxy. The code above did not work in Cloudron nor help with this issue.