HTTPS Redirect

# .env — behind a reverse proxy that terminates TLS
ENFORCE_HTTPS=true

# http request (X-Forwarded-Proto: http)
#   -> 308 redirect to the same URL in https://
# also enables the Strict-Transport-Security header (HSTS)

# With ACME (ACME_ENABLED=true), Runique serves TLS itself and its
# port-80 listener already redirects: ENFORCE_HTTPS is not needed.

// Runique must sit behind a reverse proxy (Nginx, Caddy, Railway...)
// that terminates TLS and forwards requests in HTTP.

// The proxy must SET the header itself (overwriting the client's):
//   X-Forwarded-Proto: http | https
// and pass the original Host.

// Nginx example:
//   proxy_set_header Host $host;
//   proxy_set_header X-Forwarded-Proto $scheme;

// Without X-Forwarded-Proto, no redirect happens (never a loop).
// with_upgrade_insecure() only adds a CSP directive: it does not redirect.