Change:
The header should only be if is enabled, right?
I don't think so. The description for that option says "Use https for generated links." The commit you linked is from last Feburary (which may be the version in NixOS 21.11 – I'm not sure), and on , that header is controlled by the boolean option . The upstream project recommendes this header, as far as I can tell, and the Nextcloud admin panel warns you if this is not set, so I think it is semantically correct for this header to be if the "recommended HTTP headers" flag is set, but it does get in the way if you are trying to serve Nextcloud as a Tor .onion service, where you don't want to be using SSL/TLS.
Good to hear that it is different in master, but it is not just onion services, many internal services lack tls because the vpn or tls termination is done downstream and nextcloud only speaks http. I would expect we want a single boolean to turn on/off tls, no?
I had not thought of that use case. I would say that is a good reason to have this controlled by the same flag.

Discussion:
</listitem> <listitem> <para> <ins> The Nextcloud module now allows setting the value of the <literal>max-age</literal> directive of the <literal>Strict-Transport-Security</literal> HTTP header, which is now controlled by the <literal>services.nextcloud.https</literal> option, rather than <literal>services.nginx.recommendedHttpHeaders</literal>. </para> </listitem> <listitem> <para> </ins> The <literal>spark3</literal> package has been updated from 3.1.2 to 3.2.1 (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/160075">#160075</link>):

- The Nextcloud module now supports to create a Mysql database automatically with `services.nextcloud.database.createLocally` enabled. <ins> - The Nextcloud module now allows setting the value of the `max-age` directive of the `Strict-Transport-Security` HTTP header, which is now controlled by the `services.nextcloud.https` option, rather than `services.nginx.recommendedHttpHeaders`. </ins> - The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)): - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.

''; }; <del> nginx.recommendedHttpHeaders = mkOption { type = types.bool; default = true; description = "Enable additional recommended HTTP response headers"; </del> <ins> nginx = { recommendedHttpHeaders = mkOption { type = types.bool; default = true; description = "Enable additional recommended HTTP response headers"; }; hstsMaxAge = mkOption { type = types.ints.positive; default = 15552000; description = '' Value for the <code>max-age</code> directive of the HTTP <code>Strict-Transport-Security</code> header. See section 6.1.1 of IETF RFC 6797 for detailed information on this directive and header. ''; }; </ins> }; };

add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options sameorigin; add_header Referrer-Policy no-referrer; <del> add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; </del> <ins> ''} ${optionalString (cfg.https) '' add_header Strict-Transport-Security "max-age=${toString cfg.nginx.hstsMaxAge}; includeSubDomains" always; </ins> ''} client_max_body_size ${cfg.maxUploadSize}; fastcgi_buffers 64 4K;