enable HSTS

diff --git a/etc/nginx/sites-available/default b/etc/nginx/sites-available/default
index fefa7a22f65e0c612b067d0777d28d8655d6e111..d342e98f7f5561d7c55ef5ea00d02515eea3acd7 100644 (file)
--- a/etc/nginx/sites-available/default
+++ b/etc/nginx/sites-available/default
@@ -10,6 +10,7 @@ server {
   # listen [::]:80 ipv6only=on;
   listen 443 ssl http2 default_server;
   listen [::]:443 ssl ipv6only=on; # managed by Certbot
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
   # ssl_protocols TLSv1 TLSv1.1; # support legacy browsers
   # ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";