diff --git a/pillar/id/progress_infra_opensuse_org.sls b/pillar/id/progress_infra_opensuse_org.sls
index 55ef578..c890b45 100644
--- a/pillar/id/progress_infra_opensuse_org.sls
+++ b/pillar/id/progress_infra_opensuse_org.sls
@@ -3,9 +3,8 @@ grains:
   country: de
   hostusage:
     - progress.o.o
-  roles: []
-# currently progress.i.o.o has a hand-written nginx config that differs from the config in the web_progress role
-#   - web_progress
+  roles:
+    - web_progress
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
diff --git a/pillar/role/web_progress.sls b/pillar/role/web_progress.sls
index 41510f2..6273ded 100644
--- a/pillar/role/web_progress.sls
+++ b/pillar/role/web_progress.sls
@@ -12,6 +12,7 @@ nginx:
                 - server_name: progress.opensuse.org
                 - server_tokens: 'off'
                 - client_max_body_size: 20m
+                # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
                 - add_header: Strict-Transport-Security max-age=15768000
                 - access_log: /var/log/nginx/redmine.access.log combined
                 - error_log: /var/log/nginx/redmine.error.log