HTTPS Redirect + Header Hardening Report

Generated from existing AutoRecon artifacts under results/*/scans on 2026-04-07.

1) HTTP -> HTTPS redirect on every vhost

Recommended reverse-proxy baseline (Nginx):

server {
  listen 80;
  listen [::]:80;
  server_name _;
  return 308 https://$host$request_uri;
}

Use 301 if legacy clients are incompatible with 308, but do not serve app content on :80.

2) HSTS on all HTTPS responses

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# add ; preload only after every subdomain is permanently HTTPS

3) Baseline security headers

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'" always;

4) Verification matrix (`curl` + `nmap` artifacts)

Host	HTTP :80 status	HTTPS :443 status	80->443 redirect (301/308)	HSTS	X-CTO	Referrer-Policy	CSP
auth.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	yes	yes
edge.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 404`	PASS	no	yes	no	no
familytree.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	no	no
gitea.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	no	no
gotify.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	no	no
grafana.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	no	no
influxdb.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	yes	no
kuma.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	no	no
monitor-kuma.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	no	no
nextcloud.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	yes	yes
node-red.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	yes	no
passbolt.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	no	yes
portainer.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	no	yes
prometheus.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	yes	no
searxng.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	yes	no
shifts.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	yes	yes
stockfill.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 200`	PASS	yes	yes	no	no
traefik.lan.ddnsgeek.com	`HTTP/1.1 301 Moved Permanently`	`HTTP/2 302`	PASS	yes	yes	yes	no

Verification evidence is sourced from each host's tcp_80_http_curl.html, tcp_443_https_curl.html, and tcp_443_https_nmap.txt scan outputs.

5) Per-app exceptions / tuning notes

edge.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
- Missing HSTS on HTTPS response.
familytree.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
gitea.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
gotify.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
grafana.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
influxdb.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
kuma.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
monitor-kuma.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
node-red.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
passbolt.lan.ddnsgeek.com
- Missing Referrer-Policy.
portainer.lan.ddnsgeek.com
- Missing Referrer-Policy.
prometheus.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
searxng.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
stockfill.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.
- Missing Referrer-Policy.
traefik.lan.ddnsgeek.com
- No CSP currently set; baseline policy may break inline scripts/styles without tuning.

Suggested CSP rollout approach: deploy CSP first in Content-Security-Policy-Report-Only, collect violations per app, then enforce tuned policies.

5.3 KiB Raw Blame History