From 9ee20967ca7b50a8926c99ae86fa027f8bfb0fa3 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 24 Sep 2026 00:56:22 +0200 Subject: [PATCH] RPF-WP-0047: HSTS for bao.coulomb.social only (no includeSubDomains) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4 --- argocd/platform-addons/bao-notice/default.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/argocd/platform-addons/bao-notice/default.conf b/argocd/platform-addons/bao-notice/default.conf index 13ca404..7493c08 100644 --- a/argocd/platform-addons/bao-notice/default.conf +++ b/argocd/platform-addons/bao-notice/default.conf @@ -6,6 +6,7 @@ server { root /usr/share/nginx/html; add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always; + add_header Strict-Transport-Security "max-age=31536000" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer" always; add_header Cache-Control "no-store" always;