Changeset 81bb9c5 in Klonkt for .env.example

Timestamp:

06/28/2026 03:44:15 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

897c33b

Parents:

f7d142f

git-author:

Robin Genis <roboburr@…> (06/28/2026 03:42:45 PM)

git-committer:

Robin Genis <roboburr@…> (06/28/2026 03:44:15 PM)

Message:

chore(hsts): make includeSubDomains+preload opt-in via HSTS_STRICT

Default ships a plain long max-age (safe on any domain a self-hoster runs). The
aggressive includeSubDomains+preload (which affect the operator's other subdomains and
can bake their domain into browsers) are opt-in via HSTS_STRICT=1, set on domains we own.

• server.js — build hsts options from HSTS_STRICT
• .env.example — document HSTS_STRICT

File:

• .env.example (modified) (1 diff)

.env.example

@@ -20 +20 @@
 # set it for production so email/login links point at the right place.
 PUBLIC_BASE_URL=
+
+# Strict HSTS. By default Klonkt sends a plain long max-age (safe on any domain).
+# Set HSTS_STRICT=1 ONLY if Klonkt owns the whole domain incl. all its subdomains:
+# it adds `includeSubDomains; preload`, which forces every subdomain to HTTPS and can
+# get your domain baked into browsers near-permanently. Leave unset if unsure.
+# HSTS_STRICT=1
 
 # ── Administrator ───────────────────────────────────────────────────