Force HTTPS and enable HSTS

[sipb-www.git] / .htaccess

diff --git a/.htaccess b/.htaccess
index 01e7d0987dde29955ebf3c87ea437243b74cb31c..91e2c1d6f79a58c84fe0b4f6c7ba174cdba83d24 100644 (file)
--- a/.htaccess
+++ b/.htaccess
@@ -4,18 +4,26 @@
     SetHandler none
 </Files>
 
+<If "%{HTTPS} != 'on' || %{SERVER_NAME} in {'sipb', 'sipb-www.scripts', 'sipb-www.scripts.mit.edu', 'scripts', 'scripts.mit.edu', 'scripts-cert', 'scripts-cert.mit.edu'}">
+RedirectPermanent / https://sipb.mit.edu/
+</If>
+
+Header always set Strict-Transport-Security "max-age=31536000"
+
+# /~sipb-www is only used internally
+<If "reqenv('REDIRECT_STATUS') == '' && %{SERVER_NAME} in {'sipb', 'sipb.mit.edu', 'sipb-www.scripts', 'sipb-www.scripts.mit.edu', 'scripts', 'scripts.mit.edu', 'scripts-cert', 'scripts-cert.mit.edu'}">
+RedirectPermanent /~sipb-www https://sipb.mit.edu
+</If>
+
+Options +FollowSymLinks
+
 RewriteEngine On
 RewriteBase /
 
-# Canonicalize on sipb.mit.edu
-RewriteCond %{HTTP_HOST} !^sipb.mit.edu$ [NC]
-RewriteCond %{HTTPS} !=on
-RewriteRule ^(.*)$ http://sipb.mit.edu/$1 [R=301,L]
-
 # Serve some CGI scripts from _wiki-cgi
 RewriteRule ^ikiwiki.cgi$ _wiki-cgi/ikiwiki.cgi [L]
 RewriteRule ^update.cgi$ _wiki-cgi/update.cgi [L]
-RewriteRule ^gitweb.cgi$ _wiki-cgi/gitweb.cgi [L]
+RewriteRule ^gitweb.cgi(/.*)?$ _wiki-cgi/gitweb.cgi$1 [L]
 
 # Trailing-slash directories served from _wiki
 RewriteCond %{DOCUMENT_ROOT}/_wiki%{REQUEST_URI} -d