From a73d331bbf39edc9ab7a28545e167546c9016da9 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Tue, 1 Dec 2015 17:58:02 +0000
Subject: [PATCH] Add hsts and redirect to https for keys. Ticket 4960

---
 roles/keyserver/files/sks.conf | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/roles/keyserver/files/sks.conf b/roles/keyserver/files/sks.conf
index bc359b3814..1e17732040 100644
--- a/roles/keyserver/files/sks.conf
+++ b/roles/keyserver/files/sks.conf
@@ -40,11 +40,13 @@ NameVirtualHost *:443
 <VirtualHost *:80>
         ServerAdmin sysadmin-keys-members@fedoraproject.org
         ServerName keys.fedoraproject.org
-        ProxyPass / http://127.0.0.1:11371/
-        ProxyPassReverse / http://127.0.0.1:11371/
-        SetEnv proxy-nokeepalive 1
-	ProxyVia Full
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NE]
+        # Set HSTS header via HTTP since it cannot be easily set in squid, which terminates HTTPS
+        Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
 </VirtualHost>
+
 <VirtualHost *:443>
         ServerAdmin sysadmin-keys-members@fedoraproject.org
         ServerName keys.fedoraproject.org