HSTS

tasks/apache2.yml

@@ -8,6 +8,7 @@
     - ssl
     - rewrite
     - env
+    - headers
   notify: restart apache2
 
 - name: apache2 nextcloud vhost

templates/apache-vhost.conf.j2

@@ -13,6 +13,7 @@
   {% if not certificate_provider == "selfsigned" %}
   SSLCertificateChainFile "/etc/ssl/certs/nextcloud.chain.pem"
   {% endif %}
+  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
 
   DocumentRoot {{nextcloud_directory}}