slc.is/#Grokking%20Go

server.go

package main

import (
	"crypto/tls"
	"fmt"
	"log"
	"net/http"
	"time"

	"github.com/NYTimes/gziphandler"
)

func main() {
	mux := http.NewServeMux()
	fs := http.FileServer(http.Dir("static"))
	hfs := Headers(fs)
	gfs := gziphandler.GzipHandler(hfs)

	fmt.Printf("Enabling HTTP Redirect...\n")
	go httpRedirect()

	mux.Handle("/", gfs)

	fmt.Printf("Configuring HTTPS Security...\n")
	cfg := configureTLS()
	srv := configureServer(mux, cfg)

	fmt.Printf("Server Starting...\n")
	log.Fatal(srv.ListenAndServeTLS(
		"certificate.crt",
		"private.key",
	))
}

func Headers(fs http.Handler) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
		w.Header().Set("Content-Security-Policy", "script-src 'self'; connect-src 'self'; style-src 'self'; font-src 'self'; img-src *; media-src 'self'; object-src 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; default-src 'none'; upgrade-insecure-requests")
		w.Header().Set("X-XSS-Protection", "1")
		w.Header().Set("X-Frame-Options", "sameorigin")
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("Expect-CT", "max-age=7776000, enforce")
		w.Header().Set("Permissions-Policy", "encrypted-media=(self), fullscreen=(self), sync-xhr=(self)")
		w.Header().Set("Cache-Control", "max-age=31536000")
		w.Header().Set("Set-Cookie", "__Secure-munch=true; Secure; HttpOnly; SameSite=Strict")
		// w.Header().Set("Access-Control-Allow-Origin", "*")
		w.Header().Set("Referrer-Policy", "no-referrer")

		fs.ServeHTTP(w, r)
	}
}

func httpRedirect() {
	redirectToHTTPS := func(w http.ResponseWriter, req *http.Request) {
		w.Header().Set("Connection", "close")
		url := "https://" + req.Host + req.URL.String()
		http.Redirect(w, req, url, http.StatusMovedPermanently)
	}
	srv := &http.Server{
		Addr:         ":80",
		Handler:      http.HandlerFunc(redirectToHTTPS),
		ReadTimeout:  10 * time.Second,
		WriteTimeout: 10 * time.Second,
	}
	log.Fatal(srv.ListenAndServe())
}

func configureServer(mux *http.ServeMux, cfg *tls.Config) *http.Server {
	return &http.Server{
		Addr:         ":443",
		Handler:      mux,
		TLSConfig:    cfg,
		ReadTimeout:  1 * time.Minute,
		WriteTimeout: 1 * time.Minute,
		IdleTimeout:  2 * time.Minute,
	}
}

func configureTLS() *tls.Config {
	return &tls.Config{
		MinVersion:               tls.VersionTLS12,
		PreferServerCipherSuites: true,
		CurvePreferences: []tls.CurveID{
			tls.CurveP256,
			tls.X25519,
		},
		CipherSuites: []uint16{
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
		},
	}
}