Redirect only the public HTTP ingress to canonical HTTPS

deployment/geranas/nginx.conf.in

@@ -16,6 +16,10 @@ http {
     uwsgi_temp_path /run/framebridge-publisher/uwsgi;
     scgi_temp_path /run/framebridge-publisher/scgi;
     map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+    map "$host|$http_x_forwarded_proto" $framebridge_https_redirect {
+        default 0;
+        "framebridge.betancourt.one|http" 1;
+    }
     server {
         listen 127.0.0.1:8088;
         listen @GERANAS_LAN_IP@:8088;
@@ -23,6 +27,7 @@ http {
         allow @CLOUD_LAN_IP@;
         deny all;
         server_name framebridge.betancourt.one;
+        if ($framebridge_https_redirect) { return 301 https://framebridge.betancourt.one$request_uri; }
         root /run/framebridge-publisher/site;
         index index.html;
         autoindex off;