From 076c522ccc652139aca2630731487506e8fe16ce Mon Sep 17 00:00:00 2001
From: Juice-de-Orange <200407033+Juice-de-Orange@users.noreply.github.com>
Date: Sat, 24 Oct 2026 16:33:59 +0200
Subject: [PATCH] fix: apply the HSTS sub-domains setting per host

_hsts_map.conf defined $hsts_header with the host's own value in every
host config. A map is global to nginx, so one definition won for all
hosts and the "HSTS Sub-domains" switch of the others was ignored.

Define two fixed maps instead and let _hsts.conf pick one per host.
They get new names, so configs generated before this change, which
still define $hsts_header, can't override them. The maps keep HSTS
limited to https.

Fixes #5947
---
 backend/templates/_hsts.conf     | 6 +++++-
 backend/templates/_hsts_map.conf | 7 +++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/backend/templates/_hsts.conf b/backend/templates/_hsts.conf
index 26c83ee8b..0e9829009 100644
--- a/backend/templates/_hsts.conf
+++ b/backend/templates/_hsts.conf
@@ -2,7 +2,11 @@
 {% if ssl_forced == 1 or ssl_forced == true %}
 {% if hsts_enabled == 1 or hsts_enabled == true %}
   # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
-  add_header Strict-Transport-Security $hsts_header always;
+{% if hsts_subdomains == 1 or hsts_subdomains == true %}
+  add_header Strict-Transport-Security $hsts_header_subdomains always;
+{% else %}
+  add_header Strict-Transport-Security $hsts_header_plain always;
+{% endif %}
 {% endif %}
 {% endif %}
 {% endif %}
diff --git a/backend/templates/_hsts_map.conf b/backend/templates/_hsts_map.conf
index 27dd1f8f4..f9f3339ef 100644
--- a/backend/templates/_hsts_map.conf
+++ b/backend/templates/_hsts_map.conf
@@ -1,3 +1,6 @@
-map $scheme $hsts_header {
-    https   "max-age=63072000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload";
+map $scheme $hsts_header_plain {
+    https   "max-age=63072000; preload";
+}
+map $scheme $hsts_header_subdomains {
+    https   "max-age=63072000;includeSubDomains; preload";
 }
\ No newline at end of file