Treat progmasoft.com as an HSTS-preloaded domain

.com has no HSTS requirement of its own, but progmasoft.com is served as
if it had one:

- Every HTTPS server block of progmasoft.com, www, account and viget
  sends max-age=63072000; includeSubDomains; preload. The www redirect
  sent none before.
- Plain HTTP only answers the ACME challenge and otherwise redirects to
  HTTPS, now with a permanent 308 instead of 301.
- The API's own HSTS policy, which it adds to HTTPS responses outside
  development, carries the same values, so a proxied response never
  shows two different policies. A test checks the header.

1 files changed, 8 insertions, 0 deletions

diff --git a/apps/api/Program.cs b/apps/api/Program.cs
index fd6e97b..3eb96c9 100644
--- a/apps/api/Program.cs
+++ b/apps/api/Program.cs
@@ -47,6 +47,14 @@ if (!string.IsNullOrWhiteSpace(googleClientId) && !string.IsNullOrWhiteSpace(goo
     });
 }
 builder.Services.AddProblemDetails();
+// progmasoft.com is served as if .com required HSTS: the API answers with the same preload header as Nginx, so a
+// proxied response never carries two different policies.
+builder.Services.AddHsts(options =>
+{
+    options.MaxAge = TimeSpan.FromDays(730);
+    options.IncludeSubDomains = true;
+    options.Preload = true;
+});
 builder.Services.AddHealthChecks();
 builder.Services.AddRateLimiter(options =>
 {