HSTS and Let's Encrypt

[schnappijedi]

Of course not. HTTPS redirects should occur at webserver level.

Nginx:
return 301 url$request_uri;

Apache: Forgot exact syntax but something like:
redirect 301 url