Always add HSTS

base/letsencrypt.nix

@@ -10,14 +10,8 @@
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-
     commonHttpConfig = ''
-      # Add HSTS header with preloading to HTTPS requests.
-      # Adding this header to HTTP requests is discouraged
-      map $scheme $hsts_header {
-          https   "max-age=31536000; includeSubdomains; preload";
-      }
-      add_header Strict-Transport-Security $hsts_header;
+      add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
     '';
   };
 }