Feature request: HSTS support

[cloudfoundry]

Feature request: HSTS support

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/128980925

The labels on this github issue will be updated when the story is started.

[flavorjones]

As I mentioned in the previous ticket, I'm not convinced that environment variables are the appropriate configuration mechanism.

[flavorjones]

I'd prefer for this to be configurable through the Staticfile

[nertzy]

In my opinion the ideal situation for all settings is that you can set a default value in the Staticfile but that you could also override each of those settings with environment variables.

I could see someone wanting HSTS in public-facing production-like environments, but not in lower environments if they don't want the overhead of setting up SSL everywhere.

[nertzy]

Depends on whether we consider each thing to be "internal application config" or not as per https://12factor.net/config.

[jchesterpivotal]

My own opinion is that HSTS should be a switch in the Staticfile, not an environment variable. These

Environment variables are, ideally, only there to inject app behaviour. This buildpack blurs the line between app and buildpack, but I think we should maintain the distinction nonetheless. We broke this rule for FORCE_HTTPS, which we ought to deprecate, but in general we've remained consistent.

In particular, Staticfile does not build live applications. By extension from "environment variables are for apps", if there are no apps, there should be no environment variables.

Staticfile's particular brand of snowflakery is that there's no accepted ecosystem tooling and idiom that we're relying on to create and enforce conventions. For example, in Ruby, we don't "think" about these questions much -- we just delegate to Bundler and rubygems and let them set the policy for us.

While having no default idiom or packaging seems like freedom, it's also a scope magnet. I'm personally wary of adding multiple layers of configurability because we will have to entirely own the upkeep.

[RochesterinNYC]

Closing as this has been implemented in e4efc9b