cluster-config/apps/lychee/app/route.yaml

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: lychee-headers
  namespace: lychee
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Proto: https
      X-Forwarded-SSL: off
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: web
  namespace: lychee
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`lychee.trivernis.net`)
    kind: Rule
    middlewares:
      - name: security-headers
        namespace: default
    services:
    - name: lychee
      port: http