Allow setting strict transport security header
diff --git a/apache/files/_ssl.conf b/apache/files/_ssl.conf
index 5eefcbc..5007ec7 100644
--- a/apache/files/_ssl.conf
+++ b/apache/files/_ssl.conf
@@ -5,6 +5,11 @@
SSLCertificateFile /etc/ssl/certs/{{ site.host.name }}.crt
SSLCertificateKeyFile /etc/ssl/private/{{ site.host.name }}.key
SSLCertificateChainFile /etc/ssl/certs/ca-chain.crt
+
+ {%- if site.ssl.get('forward_secrecy', False) %}
+ Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+ {%- endif %}
+
{%- set ssl_mode = site.ssl.get('mode', 'secure') %}
{%- include "apache/files/_ssl_"+ssl_mode+".conf" %}
{%- endif %}