server {
  server_name deploy.*;
  listen 80;
  return 301 https://$host/;
}

server {
  listen 443 ssl;
  server_name deploy.*;

  ssl_certificate     /etc/nginx/ssl/jenkins.crt;
  ssl_certificate_key /etc/nginx/ssl/jenkins.key;

  location / {
    proxy_pass http://localhost:8080;

    add_header "Strict-Transport-Security" "max-age=31536000";

    location /api/json {
      proxy_pass http://localhost:8080;

      add_header "Access-Control-Allow-Origin" "*";
      add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS";
      add_header "Access-Control-Allow-Headers" "origin, authorization, cookie, accept";
      add_header "Access-Control-Allow-Credentials" "true";
    }

  }
}

server {
  listen 443 ssl;
  server_name deploy.*;

  ssl_certificate     /etc/nginx/ssl/jenkins.crt;
  ssl_certificate_key /etc/nginx/ssl/jenkins.key;

  location / {
    proxy_pass http://localhost:8080;

    add_header "Strict-Transport-Security" "max-age=31536000";

    location /api/json {
      proxy_pass http://localhost:8080;

      add_header "Access-Control-Allow-Origin" "*";
      add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS";
      add_header "Access-Control-Allow-Headers" "origin, authorization, cookie, accept";
      add_header "Access-Control-Allow-Credentials" "true";
    }

  }
}

Remove HTTP virtual host from Jenkins
Remove HTTP virtual host from Jenkins

Remove the redundant HTTP (non-SSL) virtual host from Jenkins.

We firewalled access to port 80 on Jenkins in this commit:
https://github.gds/gds/govuk-provisioning/commit/60fecd1e45559e7a19229bd43ac841a961a1a25a

See the discussion here for an explanation of why:
https://github.gds/gds/govuk-provisioning/pull/81#discussion-diff-3664
