From cab61b78e70fcb186e02fa821cad91fd90c1ea87 Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Sat, 31 Oct 2026 17:47:21 -0600
Subject: [PATCH] Send HSTS on every Caddy site

Browsers will use HTTPS for each site for a year. includeSubDomains is
left off so hosts not served by this Caddy are unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 roles/docker/templates/Caddyfile.j2 | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index 71ae2a8..85a82af 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -1,42 +1,58 @@
+# Tell browsers to always use HTTPS for each site for a year. No
+# includeSubDomains, so hosts not served here are unaffected.
+(hsts) {
+    header Strict-Transport-Security "max-age=31536000"
+}
+
 {{ subdomains.pocketid }} {
+    import hsts
     reverse_proxy pocket-id:1411
 }
 
 paper.thesatelliteoflove.com {
+    import hsts
     reverse_proxy paperlessngx-webserver-1:8000
 }
 
 cal.thesatelliteoflove.com {
+    import hsts
     redir /.well-known/caldav /dav.php 302
     redir /.well-known/carddav /dav.php 302
     reverse_proxy baikal-baikal-1:80
 }
 
 {{ subdomains.books }} {
+    import hsts
     reverse_proxy kavita:5000
 }
 
 audio.thesatelliteoflove.com {
+    import hsts
     reverse_proxy audiobookshelf-audiobookshelf-1:80
 }
 
 loclog.thesatelliteoflove.com {
+    import hsts
     reverse_proxy dawarich_app:3000
 }
 
 watcher.thesatelliteoflove.com {
+    import hsts
     reverse_proxy changedetection:5000
 }
 
 snippets.thesatelliteoflove.com {
+    import hsts
     reverse_proxy bytestash:5000
 }
 
 git.thesatelliteoflove.com {
+    import hsts
     reverse_proxy gitea:3000
 }
 
 thesatelliteoflove.com {
+    import hsts
     # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
     # domain is this apex) and Tailscale, which finds the tailnet's login
     # provider through the OpenID issuer link.
@@ -56,27 +72,33 @@ thesatelliteoflove.com {
 }
 
 bookmarks.thesatelliteoflove.com {
+    import hsts
     reverse_proxy hoarder-web-1:3000
 }
 
 social.thesatelliteoflove.com {
+    import hsts
     reverse_proxy gotosocial:8080
 }
 
 models.thesatelliteoflove.com {
+    import hsts
     reverse_proxy manyfold-app-1:3214
 }
 
 
 gotify.thesatelliteoflove.com {
+    import hsts
     reverse_proxy gotify:80
 }
 
 gotify-assistant.thesatelliteoflove.com {
+    import hsts
     reverse_proxy igotify-assistant:8080
 }
 
 pdg.thesatelliteoflove.com {
+    import hsts
     root * /srv/pdg
     try_files {path} {path}.html {path}/ =404
     file_server
@@ -89,32 +111,39 @@ pdg.thesatelliteoflove.com {
 }
 
 starpunk.thesatelliteoflove.com {
+    import hsts
     reverse_proxy starpunk:8000
   }
 
 repair.nerder.land {
+    import hsts
     root * /srv/repair
     file_server
 }
 
 nerder.land {
+    import hsts
     root * /srv/nerderland
     file_server
 }
 
 forms.nerder.land {
+    import hsts
     reverse_proxy heyform-heyform-1:9157
 }
 
 listmonk.nerder.land {
+    import hsts
     reverse_proxy listmonk:9000
 }
 
 repaircafe.nerder.land {
+    import hsts
     redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
 }
 
 gokapi.thesatelliteoflove.com {
+    import hsts
     reverse_proxy gokapi:53842
 }