From 1f84705450d46bac5b0bf071f18298eaa9fafe60 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 8 Dec 2017 00:17:53 +0100
Subject: [PATCH] net/haproxy: do not enable HSTS unconditionally

---
 .../service/templates/OPNsense/HAProxy/haproxy.conf         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index b6b70b8b0..bf9296f66 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -606,10 +606,10 @@ frontend {{frontend.name}}
 {%           if frontend.ssl_cipherList|default("") != "" %}
 {%             do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
 {%           endif %}
-{%         endif %}
-{#         # HSTS #}
-{%         if frontend.ssl_hstsEnabled|default("") == '1' %}
+{#           # HSTS #}
+{%           if frontend.ssl_hstsEnabled|default("") == '1' %}
     http-response set-header Strict-Transport-Security max-age={{frontend.ssl_hstsMaxAge}}
+{%           endif %}
 {%         endif %}
 {%       endif %}
 {#       # bind/listen configuration #}