github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat: Enable HSTS by default

Browse Source 
This enables the HSTS header by default when an SSL certificate is in use. HSTS options can also be managed via the nginx:set command, which also exposes the ability to disable HSTS for your application.
This commit is contained in:
Jose Diaz-Gonzalez
2020-02-01 21:16:39 -05:00
parent d42fb02136
commit 73e7ff7b18
8 changed files with 151 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
plugins/nginx-vhosts/internal-functions
View File

@@ -37,6 +37,10 @@ cmd-nginx-report-single() {
local flag_map=(
"--nginx-bind-address-ipv4: $(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv4" "")"
"--nginx-bind-address-ipv6: $(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv6" "::")"
"--nginx-hsts: $(fn-plugin-property-get-default "nginx" "$APP" "hsts" "true")"
"--nginx-hsts-include-subdomains: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-include-subdomains" "true")"
"--nginx-hsts-max-age: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-max-age" "15724800")"
"--nginx-hsts-preload: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-preload" "false")"
)
if [[ -z "$INFO_FLAG" ]]; then
@@ -65,6 +69,38 @@ cmd-nginx-report-single() {
fi
}
fn-nginx-vhosts-manage-hsts() {
declare APP="$1" SSL_ENABLED="$2"
local HSTS="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts" "true")"
local HSTS_INCLUDE_SUBDOMAINS="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-include-subdomains" "true")"
local HSTS_MAX_AGE="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-max-age" "15724800")"
local HSTS_PRELOAD="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-preload" "false")"
local NGINX_HSTS_CONF="$DOKKU_ROOT/$APP/nginx.conf.d/hsts.conf"
local HSTS_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/hsts.conf.sigil"
if [[ "$HSTS" == "false" ]] || [[ "$SSL_ENABLED" != "true" ]]; then
rm -rf "NGINX_HSTS_CONF"
return
fi
dokku_log_verbose_quiet "Enabling HSTS"
local HSTS_HEADERS=""
if [[ -n "$HSTS_MAX_AGE" ]]; then
HSTS_HEADERS="max-age=$HSTS_MAX_AGE"
fi
if [[ "$HSTS_INCLUDE_SUBDOMAINS" == "true" ]]; then
HSTS_HEADERS+="; includeSubdomains"
fi
if [[ "$HSTS_PRELOAD" == "true" ]]; then
HSTS_HEADERS+="; preload"
fi
mkdir -p "$DOKKU_ROOT/$APP/nginx.conf.d"
sigil -f "$HSTS_TEMPLATE" HSTS_HEADERS="$HSTS_HEADERS" | cat -s >"$NGINX_HSTS_CONF"
}
fn-nginx-vhosts-uses-openresty() {
declare desc="returns whether openresty is in use or not"