From d1770a87e56f5d9e3351c0f9cb0722836d54e10d Mon Sep 17 00:00:00 2001
From: Phil <phil@tsol.re>
Date: Sat, 31 Oct 2026 17:49:15 -0600
Subject: [PATCH] Let Caddy's HSTS header replace the one HeyForm sends

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 roles/docker/templates/Caddyfile.j2 | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index 85a82af..082e0be 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -1,7 +1,11 @@
 # Tell browsers to always use HTTPS for each site for a year. No
 # includeSubDomains, so hosts not served here are unaffected.
+# defer: replace any HSTS header an app sends itself, so there's only one.
 (hsts) {
-    header Strict-Transport-Security "max-age=31536000"
+    header {
+        Strict-Transport-Security "max-age=31536000"
+        defer
+    }
 }
 
 {{ subdomains.pocketid }} {