Skip to content

Commit d5de0d6

Browse files
MeflMefl
authored
add hsts header from nginx proxy
1 parent 1e55b2e commit d5de0d6

File tree

6 files changed

+54
-0
lines changed

6 files changed

+54
-0
lines changed

‎admin/servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ split_clients "${request_id}" $upstream_host {
5959
* <%= ENV['APP'].gsub(/^pix-[^-]+-/, "pix-api-") %>.<%= ENV['API_HOST_SUFFIX'] || 'scalingo.io' %>;
6060
}
6161

62+
#add a catch all on http port to forward to the convenient https
63+
server {
64+
listen 80 default_server;
65+
server_name _;
66+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
67+
return 301 https://$host$request_uri;
68+
}
69+
6270
server {
6371
access_log logs/access.log keyvalue;
6472
server_name localhost;
@@ -119,6 +127,7 @@ server {
119127
add_header X-Content-Type-Options "nosniff";
120128
add_header X-Frame-Options "SAMEORIGIN";
121129
add_header X-XSS-Protection 1;
130+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
122131

123132
<% ENV.each do |key,value|
124133
if key.start_with? 'ADD_HTTP_HEADER' %>

‎certif/servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ split_clients "${request_id}" $upstream_host {
5959
* <%= ENV['APP'].gsub(/^pix-[^-]+-/, "pix-api-") %>.<%= ENV['API_HOST_SUFFIX'] || 'scalingo.io' %>;
6060
}
6161

62+
#add a catch all on http port to forward to the convenient https
63+
server {
64+
listen 80 default_server;
65+
server_name _;
66+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
67+
return 301 https://$host$request_uri;
68+
}
69+
6270
server {
6371
access_log logs/access.log keyvalue;
6472
server_name localhost;
@@ -136,6 +144,7 @@ server {
136144
add_header X-Content-Type-Options "nosniff";
137145
add_header X-Frame-Options "SAMEORIGIN";
138146
add_header X-XSS-Protection 1;
147+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
139148

140149
<% ENV.each do |key,value|
141150
if key.start_with? 'ADD_HTTP_HEADER' %>

‎junior/servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,14 @@ upstream api {
3636
server <%= ENV['APP'].gsub(/^pix-[^-]+-/, "pix-api-") %>.<%= ENV['API_HOST_SUFFIX'] || 'scalingo.io' %>:443 max_fails=<%= ENV['NGINX_UPSTREAM_MAX_FAILS'] || 3 %> fail_timeout=<%= ENV['NGINX_UPSTREAM_FAIL_TIMEOUT'] || '5s' %>;
3737
}
3838

39+
#add a catch all on http port to forward to the convenient https
40+
server {
41+
listen 80 default_server;
42+
server_name _;
43+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
44+
return 301 https://$host$request_uri;
45+
}
46+
3947
server {
4048
access_log logs/access.log keyvalue;
4149
server_name localhost;
@@ -114,6 +122,7 @@ server {
114122
add_header X-Content-Type-Options "nosniff";
115123
add_header X-Frame-Options "SAMEORIGIN";
116124
add_header X-XSS-Protection 1;
125+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
117126

118127
<% ENV.each do |key,value|
119128
if key.start_with? 'ADD_HTTP_HEADER' %>

‎mon-pix/servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ split_clients "${request_id}" $upstream_host {
5959
* <%= ENV['APP'].gsub(/^pix-[^-]+-/, "pix-api-") %>.<%= ENV['API_HOST_SUFFIX'] || 'scalingo.io' %>;
6060
}
6161

62+
#add a catch all on http port to forward to the convenient https
63+
server {
64+
listen 80 default_server;
65+
server_name _;
66+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
67+
return 301 https://$host$request_uri;
68+
}
69+
6270
server {
6371
access_log logs/access.log keyvalue;
6472
server_name localhost;
@@ -143,6 +151,7 @@ server {
143151
add_header X-Content-Type-Options "nosniff";
144152
add_header X-Frame-Options "SAMEORIGIN";
145153
add_header X-XSS-Protection 1;
154+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
146155

147156
<% ENV.each do |key,value|
148157
if key.start_with? 'ADD_HTTP_HEADER' %>

‎orga/servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ split_clients "${request_id}" $upstream_host {
5959
* <%= ENV['APP'].gsub(/^pix-[^-]+-/, "pix-api-") %>.<%= ENV['API_HOST_SUFFIX'] || 'scalingo.io' %>;
6060
}
6161

62+
#add a catch all on http port to forward to the convenient https
63+
server {
64+
listen 80 default_server;
65+
server_name _;
66+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
67+
return 301 https://$host$request_uri;
68+
}
69+
6270
server {
6371
access_log logs/access.log keyvalue;
6472
server_name localhost;
@@ -136,6 +144,7 @@ server {
136144
add_header X-Content-Type-Options "nosniff";
137145
add_header X-Frame-Options "SAMEORIGIN";
138146
add_header X-XSS-Protection 1;
147+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
139148

140149
<% ENV.each do |key,value|
141150
if key.start_with? 'ADD_HTTP_HEADER' %>

‎servers.conf.erb

+9
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ log_format keyvalue
1616
# as we are about to override it in the server directive here below
1717
access_log off;
1818

19+
#add a catch all on http port to forward to the convenient https
20+
server {
21+
listen 80 default_server;
22+
server_name _;
23+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
24+
return 301 https://$host$request_uri;
25+
}
26+
1927
server {
2028
access_log logs/access.log keyvalue;
2129
server_name localhost;
@@ -39,6 +47,7 @@ server {
3947
add_header X-Content-Type-Options "nosniff";
4048
add_header X-Frame-Options "SAMEORIGIN";
4149
add_header X-XSS-Protection 1;
50+
add_header Strict-Transport-Security "max-age=31536001; includeSubDomains; preload";
4251

4352
<% ENV.each do |key,value|
4453
if key.start_with? 'ADD_HTTP_HEADER' %>

0 commit comments

Comments
 (0)