feat: Enable HSTS by default

This enables the HSTS header by default when an SSL certificate is in use. HSTS options can also be managed via the nginx:set command, which also exposes the ability to disable HSTS for your application.

docs/configuration/nginx.md

@@ -14,6 +14,8 @@ nginx:validate [<app>] [--clean]         # Validates and optionally cleans up in
 
 ## Binding to specific addresses
 
+> New as of 0.19.2
+
 By default, nginx will listen to all interfaces (`[::]` for IPv6, `0.0.0.0` for IPv4) when proxying requests to applications. This may be changed using the `bind-address-ipv4` and `bind-address-ipv6` properties. This is useful in cases where the proxying should be internal to a network or if there are multiple network interfaces that should respond with different content.
 
 ```shell
@@ -32,6 +34,26 @@ dokku nginx:set node-js-app bind-address-ipv6
 
 Users with apps that contain a custom `nginx.conf.sigil` file will need to modify the files to respect the new `NGINX_BIND_ADDRESS_IPV4` and `NGINX_BIND_ADDRESS_IPV6` variables.
 
+## HSTS Header
+
+> New as of 0.20.0
+
+If SSL certificates are present, HSTS will be automatically enabled. It can be toggled via `nginx:set`:
+
+```shell
+dokku nginx:set node-js-app hsts true
+dokku nginx:set node-js-app hsts false
+```
+
+The following options are also available via the `nginx:set` command:
+
+- `hsts` (type: boolean, default: `true`): Enables or disables HSTS for your application.
+- `hsts-include-subdomains` (type: boolean, default: `true`): Tells the browser that the HSTS policy also applies to all subdomains of the current domain.
+- `hsts-max-age` (type: integer, default: `15724800`): Time in seconds to cache HSTS configuration.
+- `hsts-preload` (type: boolean, default: `false`): Tells most major web browsers to include the domain in their HSTS preload lists.
+
+Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails until the max-age is reached.
+
 ## Checking access logs
 
 You may check nginx access logs via the `nginx:access-logs` command. This assumes that app access logs are being stored in `/var/log/nginx/$APP-access.log`, as is the default in the generated `nginx.conf`.
@@ -197,10 +219,6 @@ See the [default site documentation](/docs/configuration/domains.md#default-site
 
 See the [load balancer documentation](/docs/configuration/ssl.md#running-behind-a-load-balancer).
 
-## HSTS Header
-
-See the [HSTS documentation](/docs/configuration/ssl.md#hsts-header).
-
 ## SSL Configuration
 
 See the [ssl documentation](/docs/configuration/ssl.md).

docs/configuration/ssl.md

@@ -113,9 +113,9 @@ dokku certs:report node-js-app --ssl-enabled
 
 ## HSTS Header
 
-The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. Dokku does not, by default, enable this header. It is thus left up to you, the user, to enable it for your site.
+The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. Dokku does not enables this header by default
 
-Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails.
+See the [NGINX HSTS documentation](/docs/configuration/nginx.md#hsts-header) for more information.
 
 ## HTTP/2 support