Add HSTS to tootpick.org instance?

[bwbroersma]

Nice project. Also nice the site itself is not hosted on GitHub.
I did notice HSTS is missing, preferably it's also preloaded.

Background:

• See 'Web application guidelines, detailed version' from NCSC-NL, guideline U/WA.05 (in Dutch)
• Nowadays HSTS is also required for Dutch governmental websites and applications.

[Juerd]

Benjamin W. Broersma skribis 2023-09-29 13:39 (-0700):

Nice project.

Thanks!

Also nice the site itself is not hosted on GitHub.

I have bad news for you. It is.

I did notice [HSTS](https://internet.nl/site/tootpick.org/2364861/#sitetls) is missing, preferably it's also [preloaded](https://hstspreload.org/?domain=toothpick.org).

Per isaacs/github#1249 it seems that HSTS is still not supported on custom domains for GitHub pages.

[bwbroersma]

Not sure what traffic the instance is using, https://www.statichost.eu is EU based and has the option with _headers to set all headers, including HSTS (which it also serves by default). The free tier includes 10GB traffic. Note there is no DNSSEC on statichost.eu (see dnssec-analyzer). But since the apex is used CNAME is not an option, but would not be the preferred setup anyway (since no SPF or Null MX is served by statichost.eu, although currently there is not SPF, Null MX or DMARC either).

Can be swapped by another commercial alternatives with a free tier like Appwrite Sites, Cloudflare Pages, Netlify, Render or Vercel (but those are all US based). Or a free open source git-pages instance, like grebedoc.dev (serves HSTS with only a max-age by default, cannot be changed with _headers) or codeberg.page.

Most services (except for GitHub Pages) support a Netlify format _headers and _redirects file.