So, for future readers, I report what I've done:

In /etc/nginx/sites-available/00-default-ssl.conf I've add

include /etc/nginx/templates/headermaxsecurity.tmpl;

Then i create file /etc/nginx/templates/headermaxsecurity.tmpl with inside

add_header X-Frame-Options "deny" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Content-Security-Policy "default-src 'self'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()" always;

systemctl restart nginx

Now i have A+ in both test

I'm not an header expert so any tips or suggestions are welcome.

Hello Zhang,

sorry, I didn't notice an header.conf already exist on the server, this is why some headers were already set even in my first security scan, when I scored "B".

I just tried some debugging, to understand: when i enable hsts.tmpl (adding include /etc/nginx/templates/hsts.tmpl; to file /etc/nginx/sites-available/00-default-ssl.conf ), the file header.conf is not considered anymore. I just tried doing some edit (adding/removing headers) and restarting nginx: nothing changes, whatever I write.

If i remove the use of file /etc/nginx/templates/hsts.tmpl; than the header.conf works again. Looks like I can't put add_header instruction in two different file.

To be clear: This it's not a problem, I can just move all the headers in a single file...

Howewer:
if I put all the header (HSTS included) in the default single file /etc/nginx/conf-available/headers.conf something does not work, I see an empty SOGO login page.

So i went back to the solution I propose in my post #3, this way everything works and I score A+ in the test.

To summarize:

added in /etc/nginx/sites-available/00-default-ssl.conf

    include /etc/nginx/templates/hsts.tmpl;
    include /etc/nginx/templates/headermaxsecurity.tmpl;

Than in /etc/nginx/templates/headermaxsecurity.tmpl :

add_header X-Frame-Options "deny" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options noopen;
add_header Content-Security-Policy "default-src 'self'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()" always;

and in /etc/nginx/templates/hsts.tmpl :

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

This way, everything works and I have A+ in every test.

Once again, any tips or suggestions are welcome.

I'm using iRedMail Easy, so in /opt/iredmail/custom/nginx/sites-conf.d/default-ssl/

I created file headers.conf, with contents:

add_header X-Frame-Options "deny" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options noopen;
add_header Content-Security-Policy "default-src 'self'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

then sudo /etc/init.d/nginx reload

And I get A+ on both measurement sites.

Thanks all!

Ted