Add a handler to every route adding response header

README.md

@@ -25,3 +25,12 @@ and providing cert and key files at the specified location. This is mostly for
 dev and testing setups and is not useful for a public domain as the cert is not
 issued by a trusted CA and therefore not trusted by browsers. If set, this
 overrules `ENABLE_AUTO_HTTPS`.
+
+## HSTS (HTTP Strict-Transport-Security)
+
+Set `HSTS=<header_value>` in order to add the HTTP header
+
+    Strict-Transport-Security: <header_value>
+
+to every response. See [mozilla's documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)
+for more details.

caddy_base.json

@@ -189,9 +189,9 @@
             {
               "handle": [
                 {
+                  "handler": "static_response",
                   "body": "Misdirected Request",
                   "close": true,
-                  "handler": "static_response",
                   "status_code": 421
                 }
               ],

entrypoint

@@ -64,4 +64,10 @@ else
   jq_write "del(.apps.http.servers.srv0.routes[-2])"
 fi
 
+### Strict-Transport-Security ###
+if [ -n "$HSTS" ]; then
+  handler="{ \"handler\": \"headers\", \"response\": { \"add\": { \"Strict-Transport-Security\": [ \"${HSTS}\" ] } } }"
+  jq_write ".apps.http.servers.srv0.routes[].handle |= [ ${handler} ] + ."
+fi
+
 exec "$@"