This parameterizes the HTTP Strict Transport Security header so we
can use it consistently across all templates. Also, it updates the
max-age to be ~1 year in seconds, which is recommended by Google.
See: https://hstspreload.org/
I realized the other day that due to complex logic in the location
blocks, various WordPress static files like images and stylesheets
didn't get the HTTP Strict Transport Security header set. We need
to include it on each level where we are setting headers, because
nginx overwrites headers if you set them again in a child block.
Use "public" with "max-age" instead of Expires, as "max-age" is always
preferred if it's present. Note: setting "public" doesn't make the
resource "more cacheable", but it is just more explicit.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
My WordPress blogs have a /wordpress subdirectory in the document
root, but I don't serve from the /wordpress URI.
Technically, all we need is the tweaks to the try_files:
- `?args` passes query strings to php5-fpm
- removing 404 from the vhost's try_files so we don't return 404
when the requested file doesn't exist (obviously not all request
URI's in WordPress are actual files on the disk)
Signed-off-by: Alan Orth <alan.orth@gmail.com>
