Documented and enabled the HTTPS redirect in the Website service.

2026-08-24 17:37:33 +02:00
parent f6a77305ac
commit 5996a78ff3
1 changed files with 13 additions and 0 deletions
@@ -125,6 +125,19 @@ every `GET`/`HEAD` whose path ends in a slash is answered with a `301` to the fo
 `Location` is relative, so it keeps the request's own scheme and host. Other methods pass through, since a client may repeat a redirected `POST` as a
 `GET` and drop the body.

+### HTTPS redirect
+| Config key | Environment variable | Default | Description |
+| --- | --- | --- | --- |
+| `https.trustForwardedProto` | `HTTPS_TRUST_FORWARDED_PROTO` | `false` | Read the visitor's scheme from the `X-Forwarded-Proto` header and answer the plain-HTTP ones with `301 Moved Permanently` to the same path on `site.origin`. Enable **only** behind a reverse proxy that sets the header — it is the sole trigger. |
+
+Redirecting collapses the `http://` and `https://` copies of every page onto one address, which is what a search engine consolidates a site's signals against. Three details:
+
+- **`301`, not `302`** — a temporary redirect keeps the HTTP URLs indexed. Browsers cache it for a long time, so settle the target first.
+- **Target built from `site.origin`, not the `Host` header** — a client cannot steer it. An origin that is not itself HTTPS disables the middleware instead of looping.
+- **`/.well-known/` is exempt** — redirecting the ACME challenge path breaks certificate renewal.
+
+`docker-compose.yml` enables it for production; `docker-compose.override.yml` pins it off for local development.
+
 ### Logging
 | Config key | Environment variable | Default | Description |
 | --- | --- | --- | --- |