title: Nginx proxy. Issue with CSP in case of HTTPS
body: <p>I am building a custom Nginx docker image able to automate transition to HTTPS. By the end of the <strong>entrypoint.sh</strong>, Here is what the conf looks like.  </p>
  
  <pre><code>upstream some.domain.com{
      server wordpress:80;
  }
  
  server {
      listen 80;
      server_name some.domain.com;
      add_header Content-Security-Policy "default-src 'self' ; script-src 'self' 'unsafe-inline';style-src 'self' 'unsafe-inline';img-src 'self' ; connect-src 'self' ; font-src 'self' fonts.g$
      location / {
          proxy_pass http://some.domain.com;
      }
  
      listen 443 ssl; # managed by Certbot
      ssl_certificate /etc/letsencrypt/live/some.domain.com/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/some.domain.com/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
  
  }
  </code></pre>
  
  <p>This raises <strong>CSP exceptions</strong>. If I understand, this is because <code>self</code> is now <code>https://some.domain.com</code> and not <code>http://some.domain.com</code> anymore: (sorry, my browser speaks french)</p>
  
  <pre><code>Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à http://some.domain.com/wp-includes/js/wp-emoji-release.min.js?ver=5.2.3 (« script-src »).
  </code></pre>
  
  <h2>Alternatives</h2>
  
  <p>How to deal with this issue? when I replace <code>http://some.domain.com</code> with <code>https://some.domain.com</code> in the <em>location</em> clause, I only get Errors 502 Bad Gateway. If I have to change something on the application side because of this change on the proxy, the latter does not look like a plug and play proxy anymore</p>
  
  <p>My second thought was to get rid of <code>self</code> and explicitly allowing <code>http://some.domain.com</code> in the CSP but it does not feel right either. The point is, precisely, to make everything go through and HTTPS session. </p>
  
  <p>Are redirect / rewrite clauses an option? Did cerbot do its job properly? Any insights are welcome</p>