A clean way to detect HTTPS behind a proxy in development

I really like using Orbstack over the normal Docker Desktop engine for my local development environment.

One of the features it includes is automatic TLS termination. Think of it like putting Cloudflare in front of your site, and not having to worry about generating certificates anymore.

This is especially nice locally, since you don't have to deal with generating self-signed certificates.

But one of the tradeoffs, the same tradeoff you'd have with Cloudflare, is that you now have a proxy server in front of your web server and Laravel application.

Because of this, your Laravel app doesn't know it's running on HTTPS, so when you use the various URL and route helpers, your URLs all start with http:// instead of https://.

You could "fix" this by calling URL::forceScheme('https');, but this feels like an ugly hack to me.

Another approach would be to configure the TrustProxies middleware, but the Orbstack IP could be different from machine to machine, and it feels sloppy to have local dev configuration shipped to production where it's not even needed.

We can do better!

The solution is found in the web server config. Our local nginx container has a pretty standard nginx.conf, but if we make one small addition, we solve our problem:

# at the end of the PHP location block

set $https_flag off;
if ($http_x_forwarded_proto = "https") {
  set $https_flag on;
}
fastcgi_param HTTPS $https_flag;

Nginx doesn't support if / else blocks, so we have to first initialize our flag to off. (There are other ways to do this, but I like this approach for its clarity.)

Next, we look for a header that Orbstack sets if it's proxying an HTTPS connection. If it's present, we toggle our flag to on.

Finally, we pass that flag into PHP-FPM through a fastcgi_param. Those parameters are what ultimately get used inside our Laravel application to construct the incoming Request object.

With all this in place, Laravel now properly sees when the browser request is over HTTPS, even when it's being proxied by Orbstack, and we haven't messed with anything in production.

Here to help,

Joel

P.S. Would you like help setting up a productive local development environment? Let's discuss!