+1 to caddy. There are some services that set safe headers following the recommendations outlined by Mozilla but others don't control headers as strictly. Caddy is the only web server that I found that supports loose default header values. These values will be selected unless the upstream application specifies their own values.
You can do something similar in nginx but it requires playing with maps and has a little more indirection than I'd like.
Just wish caddy was capable of starting as root and stepping down permissions like Nginx. I have certs being managed by other tools and have to make sure they are installed and chowned for caddy's use when they are cycled.