hm 
It is my understanding that the way Discourse works is that the Nginx change you just made inside that container will be wiped out on the very next ./launcher rebuild app or via UI upgrade.
If you want that change to persist, you shouldn’t edit inside the running Discourse container. But instead, make the change in /var/discourse/containers/app.yml so it persists across rebuilds and updates.
Once added, you can rebuild:
./launcher rebuild app
Not everyone uses Cloudflare, but that’s why I went with Cloudflare for this fix. Didn’t have to rebuild and just a temp workaround.
Since security headers work so that the last one received is what the browser honors, works.
It was just the quickest and least intrusive way to get things working. But if you’re doing it inside the container, just keep in mind you’ll have to redo it every time you rebuild or update Discourse. 