Add HSTS to caddy configuration

[pondzix]

New control-plane endpoint /add-hsts, when invoked modifies this part of Caddyfile:

:8443 {
    import protectedPaths

    @isHttps {
        header X-Forwarded-Proto https
    }

    route {
      handle @isHttps {
        import handleProtectedPaths
      }
      redir @protectedPaths https://{host}{uri}
    }

    import handleCollector
}

to

:8443 {
    import protectedPaths

    @isHttps {
        header X-Forwarded-Proto https
    }

    route {
      handle @isHttps {
        import handleProtectedPaths
        header Strict-Transport-Security max-age=31536000; includeSubDomains
      }
      redir @protectedPaths https://{host}{uri}
    }

    import handleCollector
}

So adds header Strict-Transport-Security max-age=31536000; includeSubDomains HSTS response header to HTTPS calls.

[stanch]

Do we have any other http(s) endpoints there that we need to slap hsts on? like the control plane itself Never mind, seems like it’s part of handleProtectedPaths

[colmsnowplow]

Looks a sound approach to me.

I'm not entirely sure how caddy works but I believe it's a linux service, so I imagine the config change won't take effect until that we use sytemctl reload to reboot it.

The good news is that doing that is just a matter of calling this function.

The bad news is I'm not sure how safe it is to do so while other services are running, so it'll need some fairly annoying testing.

So, I suggest the following:

• Test this code as-is, maybe we get lucky and caddy is smart enough to just take effect
• If it doesn't work, add restartSPService("caddy"), test that it worked, and then test that the other services didn't break.
• If they did break, maybe we need to restart everything when we reload caddy.

Happy to hop on a call to help figure it out!

[colmsnowplow]

If someone more confident than I about how caddy works can tell us that reloading doesn't mess everything up (from a bit of further reading it seems that's what reload is supposed to do), then we can save ourselves some of the hassle

[colmsnowplow]

Approving on the condition that it gets tested and works. Based on reading the code looks good though!

[colmsnowplow]

LGTM!