Skip to content

Add Strict-Transport-Security header to Nginx config #691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ScharfViktor merged 2 commits into from
Mar 5, 2026
Merged

Add Strict-Transport-Security header to Nginx config #691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1b535d1
Add Strict-Transport-Security header to Nginx config
ScharfViktor Mar 4, 2026
da350fb
add to doca/admin
ScharfViktor Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/admin/getting-started/container/docker-compose/docker-external-proxy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ server {

ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# Increase max upload size (required for Tus — without this, uploads over 1 MB fail)
client_max_body_size 10M;

Expand All @@ -200,7 +200,7 @@ server {
proxy_send_timeout 3600s;
keepalive_requests 100000;
keepalive_timeout 5m;
http2_max_concurrent_streams 100;
http2_max_concurrent_streams 512;

# Prevent nginx from trying other upstreams
proxy_next_upstream off;
Expand All @@ -221,6 +221,7 @@ server {

ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# Increase max upload size to collabora editor
client_max_body_size 10M;

Expand All @@ -245,6 +246,7 @@ server {

ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

location / {
proxy_pass http://127.0.0.1:9300;
Expand Down
3 changes: 3 additions & 0 deletions ...ion-4.0/admin/getting-started/container/docker-compose/docker-external-proxy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,7 @@ server {
ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sample enables HSTS with includeSubDomains; preload by default. preload is effectively permanent once a domain is submitted/accepted in the browser preload list, and includeSubDomains can break any subdomain that isn’t served over HTTPS. Consider removing preload (and possibly includeSubDomains) from the default snippet, or add an explicit warning/note with a link to hstspreload.org and guidance on when to enable it.

Suggested change
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# HSTS: enable includeSubDomains/preload only after reviewing all subdomains and guidance at https://hstspreload.org
add_header Strict-Transport-Security "max-age=31536000" always;

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@ScharfViktor ScharfViktor Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@micbar as I understand it -> having includeSubDomains preload is too aggressive for default config.

Maybe we should remove includeSubDomains preload here opencloud-eu/opencloud-compose#228 too?

Copy link
Contributor Author

@ScharfViktor ScharfViktor Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dragonchaser FYI

# Increase max upload size (required for Tus — without this, uploads over 1 MB fail)
client_max_body_size 10M;
Expand Down Expand Up @@ -231,6 +232,7 @@ server {
ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above: enabling HSTS includeSubDomains; preload by default in documentation can cause hard-to-revert behavior and break non-HTTPS subdomains. Consider omitting preload from the example or documenting the risks/requirements.

Copilot uses AI. Check for mistakes.
# Increase max upload size to collabora editor
client_max_body_size 10M;
Expand All @@ -255,6 +257,7 @@ server {
ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same concern here: Strict-Transport-Security with includeSubDomains; preload is a strong default for a generic reverse-proxy example. Either remove preload from the snippet or add a clear note explaining the long-lived impact and when it’s appropriate to enable.

Copilot uses AI. Check for mistakes.
location / {
proxy_pass http://127.0.0.1:9300;
Expand Down