fix: verify edge-owned HSTS during deployment

2026-09-29 00:40:00 +08:00
parent 136db1d47e
commit 6d8ed567b0
5 changed files with 35 additions and 0 deletions
@@ -234,6 +234,16 @@ if [ -d "$PROJECT_DIR/backend/staticfiles" ]; then
 fi
 cd "$PROJECT_DIR/backend"
 if [ "${DJANGO_USE_HTTPS:-true}" = "true" ]; then
+  if [ "${DJANGO_HSTS_AT_EDGE:-false}" = "true" ]; then
+    curl --fail --silent --show-error --head \
+      --noproxy '*' \
+      --resolve "${HEALTH_HOST}:443:127.0.0.1" \
+      --max-time 10 \
+      "https://${HEALTH_HOST}/" |
+      tr -d '\r' |
+      grep -Eiq '^strict-transport-security:.*max-age=[1-9][0-9]*'
+    log "边缘代理 HSTS 已验证"
+  fi
  "$VENV_DIR/bin/python" manage.py check --deploy --fail-level WARNING --database default
 else
  log "临时 HTTP 模式：部署安全检查只阻断 ERROR；绑定域名后应启用 HTTPS"