Add Vaultwarden backup system and fix HTTP header validation

- Added BACKUP.md with comprehensive backup/restore documentation
- Created backup-vaultwarden.sh for automated PostgreSQL and data backups
- Created restore-vaultwarden.sh for safe backup restoration
- Fixed HTTP response validation by configuring Vaultwarden-specific headers
- Set X-XSS-Protection: 0 (as required by Vaultwarden)
- Set X-Frame-Options: SAMEORIGIN for API calls
- Removed conflicting secure-headers@file middleware
- Added custom vaultwarden-headers middleware
- Updated .gitignore to exclude backups/ directory

Backup system:
- Backs up to /srv/backups/vaultwarden/ (configurable)
- Logs to /var/log/vaultwarden/backup.log
- 30-day retention policy
- Includes PostgreSQL database, RSA key, config, and .env

Note: Backup scripts should be moved to /srv/backups/scripts/ for production use

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -22,6 +22,13 @@ services:
     labels:
       - "traefik.enable=true"
 
+      # Vaultwarden-specific security headers
+      - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-XSS-Protection=0"
+      - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Content-Type-Options=nosniff"
+      - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.Referrer-Policy=same-origin"
+      - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Robots-Tag=noindex, nofollow"
+      - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN"
+
       # HTTP to HTTPS redirect
       - "traefik.http.routers.vaultwarden-http.rule=Host(`${DOMAIN}`)"
       - "traefik.http.routers.vaultwarden-http.entrypoints=http"
@@ -36,7 +43,7 @@ services:
       - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
       - "traefik.http.routers.vaultwarden.service=vaultwarden"
       - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
-      - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,secure-headers@file,crowdsec-bouncer@file"
+      - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,vaultwarden-headers,crowdsec-bouncer@file"
 
       # WebSocket router (required for real-time sync)
       - "traefik.http.routers.vaultwarden-ws.rule=Host(`${DOMAIN}`) && Path(`/notifications/hub`)"