mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 16:47:01 +09:00
Juan DenisandClaude Opus 4.8
a09bf0fbbe
The Flask middleware emitted HSTS with includeSubDomains+preload whenever not in debug mode -- even on HTTP-only or Cloudflare-Flexible installs, where preload is a hard-to-reverse commitment. HTTPS is intentionally optional, so HSTS is now gated on the operator's recorded SSL choice. - config._resolve_ssl_mode(): SERVERKIT_SSL_MODE env -> /etc/serverkit/ssl-mode file -> safe 'insecure' default. Exposed as SSL_MODE / HSTS_ENABLED. - security middleware sends HSTS only when HSTS_ENABLED and not debug. Behind a proxy Flask can't distinguish real TLS from a Flexible edge via X-Forwarded-Proto, so we trust the installer's choice, not the request scheme. - install.sh records SERVERKIT_SSL_MODE in .env; existing installs are covered by the /etc/serverkit/ssl-mode file. The nginx edge still emits HSTS in its own secure server block, so secure installs are unaffected. Proving tests in tests/test_security_headers.py. Full backend suite: 342 passed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>