Merge pull request #4300 from AubreyHewes/pr/disable_applying_hsts_global_conf

allow disabling hsts globally and explicitly enable per app

docs/configuration/nginx.md

@@ -61,6 +61,20 @@ The following options are also available via the `nginx:set` command:
 
 Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails until the max-age is reached.
 
+#### Globally disabling the HSTS Header
+
+HSTS Header can be disabled for all apps by setting the `hsts` property to false after passing the `--global` flag to `nginx:set`. Changing this value globally or on a per-app basis will require rebuilding the nginx config via the `nginx:build-config` command.
+
+```shell
+dokku nginx:set --global hsts false
+```
+
+Once the HSTS setting is disabled globally, it can be re-enabled on a per-app basis by setting the `hsts` property as normal.
+
+```shell
+dokku nginx:set node-js-app hsts true
+```
+
 ### Checking access logs
 
 You may check nginx access logs via the `nginx:access-logs` command. This assumes that app access logs are being stored in `/var/log/nginx/$APP-access.log`, as is the default in the generated `nginx.conf`.

plugins/nginx-vhosts/command-functions

@@ -45,7 +45,9 @@ cmd-nginx-report-single() {
     "--nginx-client-max-body-size: $(fn-plugin-property-get-default "nginx" "$APP" "client-max-body-size" "")"
     "--nginx-disable-custom-config: $(fn-plugin-property-get-default "nginx" "$APP" "disable-custom-config" "false")"
     "--nginx-error-log-path: $(fn-nginx-error-log-path "$APP")"
-    "--nginx-hsts: $(fn-plugin-property-get-default "nginx" "$APP" "hsts" "true")"
+    "--nginx-global-hsts: $(fn-plugin-property-get-default "nginx" "--global" "hsts" "true")"
+    "--nginx-computed-hsts: $(fn-nginx-hsts-is-enabled "$APP")"
+    "--nginx-hsts: $(fn-plugin-property-get-default "nginx" "$APP" "hsts" "")"
     "--nginx-hsts-include-subdomains: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-include-subdomains" "true")"
     "--nginx-hsts-max-age: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-max-age" "15724800")"
     "--nginx-hsts-preload: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-preload" "false")"

plugins/nginx-vhosts/internal-functions

@@ -13,9 +13,20 @@ fn-nginx-vhosts-last-visited-at() {
   fi
 }
 
+fn-nginx-hsts-is-enabled() {
+  declare APP="$1"
+  local hsts_is_enabled="$(fn-plugin-property-get-default "nginx" "$APP" "hsts" "")"
+
+  if [[ "$hsts_is_enabled" == "" ]]; then
+    hsts_is_enabled="$(fn-plugin-property-get-default "nginx" "--global" "hsts" "true")"
+  fi
+
+  echo "$hsts_is_enabled"
+}
+
 fn-nginx-vhosts-manage-hsts() {
   declare APP="$1" SSL_ENABLED="$2"
-  local HSTS="$(fn-plugin-property-get-default "nginx" "$APP" "hsts" "true")"
+  local HSTS="$(fn-nginx-hsts-is-enabled "$APP")"
   local HSTS_INCLUDE_SUBDOMAINS="$(fn-plugin-property-get-default "nginx" "$APP" "hsts-include-subdomains" "true")"
   local HSTS_MAX_AGE="$(fn-plugin-property-get-default "nginx" "$APP" "hsts-max-age" "15724800")"
   local HSTS_PRELOAD="$(fn-plugin-property-get-default "nginx" "$APP" "hsts-preload" "false")"

plugins/nginx-vhosts/subcommands/set

@@ -10,7 +10,7 @@ cmd-nginx-set() {
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
   local VALID_KEYS=("access-log-format" "access-log-path" "bind-address-ipv4" "bind-address-ipv6" "client-max-body-size" "disable-custom-config" "error-log-path" "hsts" "hsts-include-subdomains" "hsts-preload" "hsts-max-age" "proxy-read-timeout" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value")
-  verify_app_name "$APP"
+  local GLOBAL_KEYS=("hsts")
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
 
@@ -18,6 +18,13 @@ cmd-nginx-set() {
     dokku_log_fail "Invalid key specified, valid keys include: access-log-format, access-log-path, bind-address-ipv4, bind-address-ipv6, client-max-body-size, disable-custom-config, error-log-path, hsts, hsts-include-subdomains, hsts-preload, hsts-max-age, proxy-read-timeout, proxy-buffer-size, proxy-buffering, proxy-buffers, proxy-busy-buffers-size, x-forwarded-for-value, x-forwarded-port-value, x-forwarded-proto-value"
   fi
 
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
+    if [[ "$APP" == "--global" ]]; then
+      dokku_log_fail "The key '$KEY' cannot be set globally"
+    fi
+    verify_app_name "$APP"
+  fi
+
   if [[ -n "$VALUE" ]]; then
     dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
     fn-plugin-property-write "nginx" "$APP" "$KEY" "$VALUE"

tests/unit/nginx-vhosts_6.bats

@@ -107,6 +107,56 @@ teardown() {
   assert_failure
 }
 
+@test "(nginx-vhosts) nginx:set --global hsts" {
+  setup_test_tls wildcard
+  local HSTS_CONF="/home/dokku/${TEST_APP}/nginx.conf.d/hsts.conf"
+
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS"
+
+  # disable hsts globally
+  run /bin/bash -c "dokku nginx:set --global hsts false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # check it is now not applied
+  run /bin/bash -c "dokku proxy:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS" 0
+
+  # apply on app
+  run /bin/bash -c "dokku nginx:set $TEST_APP hsts true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # check it is now applied
+  run /bin/bash -c "dokku proxy:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS" 1
+
+  # set global value to default
+  run /bin/bash -c "dokku nginx:set --global hsts"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # check it is still applied
+  run /bin/bash -c "dokku proxy:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS" 1
+}
+
 @test "(nginx-vhosts) nginx:set bind-address" {
   run deploy_app
   echo "output: $output"