🇦🇺Australia @n.a.t.j.b

Hi, I wanted to add what worked for us on a fresh nginx, varnish and Drupal 10 install (10.2.3).

Note: only core is installed so far, so no metatag or other modules causing confusion, but given this is the most in depth discussion around this topic, I'm posting here anyway in case it helps someone else save some time and frustration. The issue was apparent thanks to the rss feed link in the head tag on the "Welcome!" home page.

i.e. <link rel="alternate" type="application/rss+xml" title="" href="http://example.com/rss.xml" />

We set up the permanent (301) redirect in nginx from anything on port 80 to 443 so the page is served using https, but the absolute path for the rss link used http (all other paths are relative as expected).

The "relevant" settings to fix the issue for our environment were:

nginx

server {
    listen 443 ssl http2;
    ...
    location / {
        ...
        proxy_set_header        X-Forwarded-Proto $scheme;
        ...
    }
}

Settings.php

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = array($_SERVER['REMOTE_ADDR']);
$settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO;

Even though a few articles suggest it, the settings.php setting - $settings['reverse_proxy_proto_header'] = 'https'; - was stopping https from being used, even with the symfony setting enabled.

Lastly, we didn't need to modify the Varnish config to assist with this (it's using one of the many Drupal config recipes) - I only mention it to help others avoid going down that rabbit hole as it was irrelevant to the solution in our case.

Hope it helps, cheers.