We are transitioning an existing drupal installation to run as a SSL-only site behind a SSL offloading proxy. Drupal itself has no SSL and is running on port 80 on apache.
We've got what we think is a pretty successful configuration:
On the nginx end of the world it looks like:
server {
listen 80;
server_name staging.example.com;
return 301 https://staging.example.com$request_uri;
}
server {
listen 443 ssl;
server_name staging.example.com;
ssl_certificate $chained_cert_path
ssl_certificate_key $private_key_path;
location / {
proxy_pass http://$backend_ip;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-By $server_addr:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_redirect http:// https://;
}
}
And in the drupal site's config we are running:
// reverse proxy settings and such
$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array($proxy_ip);
$base_url = 'https://staging.example.com';
As I said this seems to be passing all tests, but my spidey sense is saying this was too easy and there is a fugly problem waiting somewhere in some part of drupal we don't understand well enough -- manually paving $base_url just isn't sitting right with me. Are there landmines here?