disable HSTS in the development setup

(to remove uninteresting warnings raised by firefox)

docker-compose.yml

@@ -145,6 +145,11 @@ services:
     volumes:
         - "/data/dev/nginx:/vol"
     networks: [dev]
+    environment:
+        # we disable HSTS in the dev environment because firefox spits many
+        # warnings in the console when HSTS is used together with a self-signed
+        # certificate.
+        NGINX_DISABLE_HSTS: 1
 
 
   # TOOLBOX

nginx/files/usr/local/sbin/update-nginx-config

@@ -21,8 +21,10 @@ security_config = lambda fqdn: """
 	ssl_certificate_key	/vol/ro/ssl/{fqdn}.key;
 
         include /etc/nginx/ssl.conf;
+	{hsts}
 
-""".format(fqdn=fqdn)
+""".format(fqdn=fqdn, hsts="more_clear_headers Strict-Transport-Security;"
+                            if os.environ.get("NGINX_DISABLE_HSTS") else "")
 
 
 # default server (returns 404)