title: Tomcat behind Nginx: how to proxy both HTTP and HTTPS, possibly on non-standard ports?
body: <h3>Description</h3>
  
  <p>We're installing some application running Tomcat 6 behind Nginx for different clients. Some of those installations are HTTP only, some HTTPS only, somewhere both. One of those installations has HTTP and HTTPS working on non-standard ports (8070 and 8071) due to lack of public IPs. Application at hand is displayed as an iframe in another app.</p>
  
  <h3>Current behaviour</h3>
  
  <p>Tomcat redirects all HTTPS requests to HTTP (so nothing displayed in iframe due to browser restrictions for mixed content).</p>
  
  <h3>Current configuration</h3>
  
  <p>Iframe code:</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;iframe src="/saiku-ui"&gt;
  </code></pre>
  
  <p>Tomcat's <code>server.xml</code>:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;Connector port="8080" protocol="HTTP/1.1"/&gt;
  &lt;!-- A bit later... --&gt;
  &lt;Valve className="org.apache.catalina.valves.RemoteIpValve"
        remoteIpHeader="x-forwarded-for"
        protocolHeader="x-forwarded-proto"
      /&gt;
  </code></pre>
  
  <p>Nginx vhost:</p>
  
  <pre><code>server {
    listen 80;
    listen 443 ssl spdy;
  
    location /saiku-ui {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://saiku-server; # This is upstream name
      proxy_redirect off;
    }
  }
  
  upstream saiku-server {
    server ip.of.tomcat.server:8080;
  }
  </code></pre>
  
  <h3>Desired behaviour</h3>
  
  <ol>
  <li><p>Tomcat should listen on one single port for both HTTP and HTTPS requests.</p>
  
  <p>If there will be two <code>&lt;Connector&gt;</code> tags it will be much harder to configure Nginx.</p></li>
  <li><p>Tomcat should not redirect between schemas.</p></li>
  <li>Nginx may listen on arbitrary ports (e.g. <code>listen 8071 ssl spdy;</code>).</li>
  <li>Links, generated by Tomcat should be either relative or include schema, host, and port as provided by Nginx.</li>
  </ol>
  
  <h3>Additional info</h3>
  
  <p>I've tried to add <code>schema</code> and <code>proxyPort</code> attributes to <code>&lt;Connector&gt;</code>, after that Tomcat will always redirect from HTTP to HTTPS (at least it's better).</p>
  
  <p>I can't google such a configuration and not experienced with Tomcat. Please help.</p>