Comment by CWuestefeld

Heads-up for BookOrbit users:

Last week they released a change that put the header Strict-Transport-Security into all responses (yes, even non-HTTPS ones!). This broke not just BookOrbit, but every other app I had running on that server, because suddenly everything being served by that host refused to work without HTTPS.

I probably should have done it sooner, but I spent a big chunk of the afternoon setting up new DNS entries so I can access each app through a different hostname. That was easy enough for me, running OPNsense with my own internal DNS, but you may not have that much flexibility in your home.

I submitted an issue (see https://github.com/bookorbit/bookorbit/issues/760) and a few days later, they created a semi-fix such that the header is only sent out in secure responses. But this still has the effect of forcing every app on that server to require HTTPS.