@kirelagin, thanks for your PR! By analyzing the history of the files in this pull request, we identified @globin, @domenkozar and @fadenb to be potential reviewers.

The only option I think is feasible to create a separate option to enable HSTS and maybe make max-age and includeSubDomains configurable.

Ok, in this case I’ll add a separate option and mention it in the documentation for forceSSL.

It's very easy to lock users out of the website, I would never enable HSTS by default, but we can make it optional.

It's very easy to lock users out of the website

Well, personally I do not think that HSTS is that scary, it does not pin a certificate and obtaining a valid certificate nowadays is incredibly easy.

Anyway, I’m thinking about something like:

virtualHosts."example.com" = {
  sslStrict = {
    enable = false;
    maxAge = 31536000;
    includeSubDomains = true;
  };
};

I am also inclined towards always sending the header, but setting max-age=0 if enable is false. That way changing enable to false will actually disable HSTS, not just stop sending the header.

Might it be a good idea to rename forceSSL to sslRedirect or something, to make it less confusing?

In case someone wonders, I still hope to get to this some time soon.

(triage) @kirelagin, do you still plan to get back to this? :)

(also, the PR title may need an update now that the objective has changed, something like “nginx: add an option to enable HSTS” maybe?)

Anyway, I’m thinking about something like:

virtualHosts."example.com" = {
  sslStrict = {
    enable = false;
    maxAge = 31536000;
    includeSubDomains = true;
  };
};

Yeah, that looks good!
We probably shouldn't, like the others mentioned, turn it on by default. But I think we can make the case that recommendedTlsSettings turns it on.
Oh and includeSubDomains should be false by default.
We should also probably set the default maxAge to a low number (like an hour) and also recommend in the docs to set it higher. (Which recommendedTlsSettings could do)

I am also inclined towards always sending the header, but setting max-age=0 if enable is false. That way changing enable to false will actually disable HSTS, not just stop sending the header.

Hmm, no I think people wouldn't expect that. You don't want to mess with the entire domain if not explicitly opted in.

Given the complications around disabling HSTS, I wouldn't like to see it enabled implicitly (like by recommendedTlsSettings), but I would love to have an option just like the suggested sslStrict for doing it manually, but easily.

(Incidentally, are there any functions in nixpkgs for dealing with units of time? It would be cool to have maxAge = lib.daysToSeconds 365 (or something more structured) instead of 31536000.)

Is anyone else working on this? If not, I will make a PR for sslStrict when I find the time.

About sending max-age=0 by default

I am also in favor of not sending the header at all if enable = false (i.e. by default). I'm not an expert on this, but I believe in some imperfect configurations, some pages on a domain might provide max-age=31536000 while other pages (perhaps served by a different server) serve no HSTS header at all - the browser will still force those non-HSTS pages to load as HTTPS as long as it has seen any HSTS page on the domain previously within the max-age window. But if those non-HSTS pages were to send max-age=0 by default, without the sysadmin's knowledge, HSTS would effectively be getting turned on and off depending on which pages are visited.

tl;dr: We should only send max-age=0 when the sysadmin specifically chooses to do so, because I think it's a non-trivial decision and we can't be certain the default won't cause problems.

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the
   related code and @ mention them in a comment.
2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
   irc.freenode.net.

I would prefer this to be a seperate option rather than beeing included by default.