alphagov/pp-puppet — pull request #456 by alexmuller (2014-06-06 10:56:42+00:00)
Title: Set an HSTS header to require SSL for 1 month

Currently we're not setting HSTS anywhere on our domains.

I'm hoping that this will avoid the annoying situation where by:

$ curl -v http://assets.performance.service.gov.uk/spotlight/stylesheets/spotlight.css

does not receive a response. Ideally we'll be able to increase this once we verify that it's working as expected. GOV.UK currently sets this to be 1 year.