Don't stress about security headers and CSP. These are there to help provide additional protection against client-side issues which may or may not be present.

These will not have any direct impact on your services you expose, rather they aim to be a last resort to protect your browser in case an attacker tries to exploit existing vulnerabilities such as a Cross Site Scripting - but not having these does not increase the risk of your server being compromised.

Use Nessus Essentials for scanning your services and have fun.

(security_headers) {  
  header {  
    Strict-Transport-Security "max-age=31536000; includeSubDomains"  
    X-Content-Type-Options "nosniff"  
    X-Frame-Options "SAMEORIGIN"  
    Referrer-Policy "no-referrer"  
    X-XSS-Protection "1; mode=block"  
    Permissions-Policy "camera=(), microphone=(), geolocation=(), accelerometer=(), autoplay=(), fullscreen=(), gyroscope=(), interest-cohort=(), magnetometer=(), payment=()"  
    -Server  
    -x-powered-by  
  }  
}