www/nginx: remove hardcoded HSTS header (#1207)

www/nginx/pkg-descr

@@ -16,6 +16,7 @@ Plugin Changelog
 * Breaking: the enabled flag in the general setting now works (en- or disables all vhosts in the plugin itself, but always serves plugins). Default was false so make sure you have it enabled before upgrade.
 * Alias support for downstream proxies (trust setting)
 * bugfix: deleting IP ACL
+* HSTS not sent automatically anymore if HTTP over TLS is configured (still available via security header)
 
 1.7
 

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf

@@ -89,7 +89,6 @@ server {
     ssl_session_cache shared:SSL:50m;
     ssl_session_tickets off;
     ssl_prefer_server_ciphers on;
-    add_header Strict-Transport-Security max-age=15768000;
 {%     do our_headers.append('Strict-Transport-Security') %}
     sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
 {%   endif %}