Editing HTTPS-only and HSTS (section)

=== Changes to Apache config files ===

==== Add the HSTS header ====

Edit [[Template:Securevhost.conf|EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf]] and add the following HSTS header after ther <tt>ServerName</tt> line.  The max-age variable is a time in seconds for how long the HSTS settings should be remembered by the browser.  15780000 is six months, which is a long time, you may want to set it to a shorter time while testing.

<syntaxhighlight lang="apache">
 Header set Strict-Transport-Security "max-age=15780000"
</syntaxhighlight>

Include this file from the core apache conf file for the secure port (443) in <tt>/etc/</tt>

==== Add 301 redirects to secure port from HTTP (port 80) ====

By making the above changes to the archive's <tt>cfg.d/10_core.pl</tt>, if you use [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] or are running [https://github.com/eprints/eprints the latest revision of EPrints on GitHub], <tt>/bin/generate_apacheconf</tt> will generate an <tt>/cfg/apache/REPOID.conf</tt>, which automatically redirects HTTP to HTTPS.  Otherwise, this can be achieved by modifying <tt>/cfg/apache/REPOID.conf</tt> to the following, substituting your domain as appropriate:

<source lang="xml">
<VirtualHost *:80>
RedirectPermanent / https://YOUR-REPOSITORY-DOMAIN/  
</VirtualHost>
</source>