We've had it on `matrix-nginx-proxy` before, but our initial support for Traefik did not include any of these security headers.
Previously, we had to run it at a subpath, like `/synapse-admin`. We can now dedicate a whole domain and the `/` path to it, should we wish to do so.
Previously, it had to go through matrix-nginx-proxy. It's exposed to Traefik directly via container labels now.