Adding HSTS to Ghost Blog

ghost_index.js

// # Ghost Startup
// Orchestrates the startup of Ghost when run from command line.

var ghost = require('./core'),
    express = require('express'),
    errors = require('./core/server/errors'),
    parentApp = express(),
    hsts = require('hsts'),
    express_enforces_ssl = require('express-enforces-ssl');


// Make sure dependencies are installed and file system permissions are correct.
require('./core/server/utils/startup-check').check();

ghost().then(function (ghostServer) {
    // Force SSL
    parentApp.enable('trust proxy');
    parentApp.use(express_enforces_ssl());

    // Force HSTS
    parentApp.use(hsts({
      maxAge: 10886400,        // Must be at least 18 weeks to be approved by Google
      includeSubDomains: true, // Must be enabled to be approved by Google
      preload: true,
      force: true
    }));

    // Mount our Ghost instance on our desired subdirectory path if it exists.
    parentApp.use(ghostServer.config.paths.subdir, ghostServer.rootApp);

    // Let Ghost handle starting our server instance.
    ghostServer.start(parentApp);
}).catch(function (err) {
    errors.logErrorAndExit(err, err.context, err.help);
});