{% set haproxy = salt["pillar.get"]("haproxy", {}) -%}

{% for domain, config in haproxy.redirects.items() -%}
server {
    listen 127.0.0.1:19002;
    server_name {{ domain }};
    add_header Strict-Transport-Security "max-age={{ config.get("hsts_seconds", 315360000) }}{% if config.get("hsts_subdomains", True) %}; includeSubDomains{% endif %}{% if config.get("hsts_preload", True) %}; preload{% endif %}";

    {% if config.get("hpkp", True) and pillar["tls"].get("pins") -%}
    # Add HPKP headers for anything that is configured to have them.
    add_header Public-Key-Pins 'max-age={{ config.get("hpkp_seconds", 2592000) }}; {% if config.get("hpkp_subdomains", True) %}includeSubDomains; {% endif %}{% for pin in pillar["tls"]["pins"] %}pin-sha256="{{ pin }}"; {% endfor %}';
    {%- endif %}

    return 301 http{% if config.get("tls", True) %}s{% endif %}://{{ config.target }}{% if config.get("request_uri", True) %}$request_uri{% endif %};
}
{% endfor %}

{% set haproxy = salt["pillar.get"]("haproxy", {}) -%}

{% for domain, config in haproxy.redirects.items() -%}
server {
    listen 127.0.0.1:19002;
    server_name {{ domain }};
    add_header Strict-Transport-Security "max-age={{ config.get("hsts_seconds", 315360000) }}{% if config.get("hsts_subdomains", True) %}; includeSubDomains{% endif %}{% if config.get("hsts_preload", True) %}; preload{% endif %}";

    return 301 http{% if config.get("tls", True) %}s{% endif %}://{{ config.target }}{% if config.get("request_uri", True) %}$request_uri{% endif %};
}
{% endfor %}

Remove HPKP support, it's mostly a bad idea at this point
Remove HPKP support, it's mostly a bad idea at this point

CT is a significantly more powerful tool for ensuring a safe ecosystem.