From 613f7f12f4c907ea07e79e3e73da8f2b71d3436d Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 20 Aug 2013 20:44:21 -0400
Subject: add HSTS if hiera value for webapp['secure'] is set (#3514)

Change-Id: Idd413349ec0b99835a1cbb4fb4c4fcef1a8fdeab
---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb         | 3 +++
 puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index 6a276e22..bc5ff156 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -22,6 +22,9 @@ Listen 0.0.0.0:<%= api_port %>
   RequestHeader set X_FORWARDED_PROTO 'https'
 
   <IfModule mod_headers.c>
+<% if @webapp['secure'] -%>
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
+<% end -%>
     Header always unset X-Powered-By
     Header always unset X-Runtime
   </IfModule>
diff --git a/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb
index 9108caff..5e3960c2 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb
@@ -22,6 +22,9 @@
   RequestHeader set X_FORWARDED_PROTO 'https'
 
   <IfModule mod_headers.c>
+<% if @webapp['secure'] -%>
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
+<% end -%>
     Header always unset X-Powered-By
     Header always unset X-Runtime
   </IfModule>
-- 
cgit v1.2.3