http:
  middlewares:
    compress:
      compress: {}

    # https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
    floc-block:
      headers:
        customResponseHeaders:
          Permissions-Policy: interest-cohort=()

    tailscale-only:
      ipAllowList:
        sourceRange:
          - "{{ tailscale_cidr }}"
          - "{{ tailscale_cidr_ipv6 }}"