fix: verify edge-owned HSTS during deployment

backend/common/test_deployment_security.py

@@ -0,0 +1,16 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_edge_hsts_ownership_is_explicit_and_verified():
+    settings = (ROOT / "backend/config/settings.py").read_text(encoding="utf-8")
+    deploy = (ROOT / "scripts/deploy_production.sh").read_text(encoding="utf-8")
+    workflow = (ROOT / ".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
+    example = (ROOT / ".env.production.example").read_text(encoding="utf-8")
+
+    assert 'os.getenv("DJANGO_HSTS_AT_EDGE", "false")' in settings
+    assert '["security.W004"]' in settings
+    assert "DJANGO_HSTS_AT_EDGE=true" in workflow
+    assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy
+    assert "DJANGO_HSTS_AT_EDGE=false" in example

backend/config/settings.py

@@ -189,6 +189,12 @@ SECURE_HSTS_SECONDS = int(
 )
 SECURE_HSTS_INCLUDE_SUBDOMAINS = USE_HTTPS
 SECURE_HSTS_PRELOAD = USE_HTTPS
+HSTS_AT_EDGE = os.getenv("DJANGO_HSTS_AT_EDGE", "false").lower() == "true"
+SILENCED_SYSTEM_CHECKS = (
+    ["security.W004"]
+    if USE_HTTPS and HSTS_AT_EDGE and SECURE_HSTS_SECONDS == 0
+    else []
+)
 
 LOGGING = {
     "version": 1,