feat(xo-server): make Helmet configurable (#4141)

packages/xo-server/config.toml

@@ -49,6 +49,12 @@ maxTokenValidity = '0.5 year'
 # Delay for which backups listing on a remote is cached
 listingDebounce = '1 min'
 
+# Helmet handles HTTP security via headers
+#
+# https://helmetjs.github.io/docs/
+#[http.helmet.hsts]
+#includeSubDomains = false
+
 [[http.listen]]
 port = 80
 

packages/xo-server/src/index.js

@@ -93,7 +93,7 @@ async function loadConfiguration() {
 function createExpressApp(config) {
   const app = createExpress()
 
-  app.use(helmet())
+  app.use(helmet(config.http.helmet))
 
   app.use(compression())