From 779d493513842a99dd71b6dd5b34ab930b4f707a Mon Sep 17 00:00:00 2001
From: Ross Miller <rossajmiller76@gmail.com>
Date: Sat, 7 Mar 2026 11:15:42 +0000
Subject: [PATCH] Optionally enable HSTS using env vars. Useful for testing

---
 BudgetApp/Program.cs       | 12 ++++++++++++
 BudgetApp/appsettings.json |  6 ++++++
 Dockerfile                 |  5 ++++-
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/BudgetApp/Program.cs b/BudgetApp/Program.cs
index c19212c..1f0e434 100644
--- a/BudgetApp/Program.cs
+++ b/BudgetApp/Program.cs
@@ -82,6 +82,18 @@ builder.Services.AddScoped<AppState>();
 
 builder.Services.AddCascadingAuthenticationState();
 
+// HSTS
+if (bool.Parse(Environment.GetEnvironmentVariable("ENABLE_HSTS") ?? "false"))
+{
+    builder.Services.AddHsts(options =>
+    {
+        var hstsSection = builder.Configuration.GetSection("Hsts");
+        options.MaxAge = TimeSpan.FromDays(hstsSection.GetValue<int>("MaxAgeDays", 365));
+        options.IncludeSubDomains = hstsSection.GetValue<bool>("IncludeSubDomains", true);
+        options.Preload = hstsSection.GetValue<bool>("Preload", false);
+    });
+}
+
 // Add services to the container.
 builder.Services.AddRazorComponents()
     .AddInteractiveServerComponents();
diff --git a/BudgetApp/appsettings.json b/BudgetApp/appsettings.json
index 264e69b..2052c81 100644
--- a/BudgetApp/appsettings.json
+++ b/BudgetApp/appsettings.json
@@ -16,6 +16,12 @@
     "Twitter": "",
     "Mastodon": ""
   },
+  "Hsts": {
+    "Domain": "nas.oneputleygreen.com",
+    "MaxAgeDays": 365,
+    "IncludeSubDomains": true,
+    "Preload": false
+  },
   "Authentication": {
     "Google": {
       "ClientId": "",
diff --git a/Dockerfile b/Dockerfile
index 6cc1625..79603f1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,6 +32,9 @@ LABEL org.opencontainers.image.title="Budgeteer" \
 # Ensure the SQLite data directory exists and is writable
 RUN mkdir -p /app/data
 
+# HSTS domain — used as the certificate CN and read by the app via Hsts:Domain config
+ENV Hsts__Domain=nas.oneputleygreen.com
+
 # Generate a self-signed TLS certificate for HTTPS
 RUN mkdir -p /app/certs && \
     openssl req -x509 -newkey rsa:4096 \
@@ -39,7 +42,7 @@ RUN mkdir -p /app/certs && \
         -out /app/certs/cert.pem \
         -days 3650 \
         -nodes \
-        -subj "/C=GB/ST=England/O=Budgeteer/CN=localhost" && \
+        -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}" && \
     openssl pkcs12 -export \
         -out /app/certs/cert.pfx \
         -inkey /app/certs/key.pem \