Test that app URLs are generated properly in the face of HTTPS

[paulproteus]

@JanJambor discussed with the paperwork team an issue where absolute URLs in Paperwork weren't being generated properly in his Sandstorm package. The problem seemed to be that $_SERVER['https'] needs to be set to on for Paperwork/Laravel to figure things out properly, but that doesn't happen with his nginx etc. setup.

(Full discussion here: paperwork/paperwork#281)

My suggestion is that we should

• 1. adjust vagrant-spk's "LEMP" (Linux ENginx MySQL PHP) configuration to handle this on behalf of frameworks, setting $_SERVER['https'] to on if the X-Forwarded-Proto is https. Having said that, I haven't dug into the sandstorm-http-bridge setup enough to find out if that's going to be feasible.
• 1. Use absolute CSS URLs in https://github.com/paulproteus/php-app-to-package-for-sandstorm app to be able to test that the handling works properly.

Relevant links:

• http://laravel-tricks.com/tricks/force-generation-of-http-https-link-if-behind-caching-server
• http://laravel-tricks.com/tricks/fix-ssl-in-laravel-4-when-server-is-behind-a-load-balancer-or-a-reverse-proxy

[paulproteus]

For another take, see @drenshaw's WordPress package:

https://github.com/dwrensha/wordpress-sandstorm/blob/2fbe2f9bcdd3782ea577ba1ab69a48944b6b87be/wp-config.php#L26

particularly:

if (isset($headers['X-Sandstorm-Base-Path'])) {
   $sandstorm_base_path = $headers['X-Sandstorm-Base-Path'];
}
if ('https' == substr($sandstorm_base_path, 0, 5)) {
  $_SERVER['HTTPS'] = 'on';
}

I like this a lot.

I also think it should be part of the "Sandstorm vagrant-spk LEMP platform" that it always runs PHP with some environment variable indicating that the app is running within Sandstorm, so that PHP apps can reliably detect if to use their Sandstorm-specific code paths or not, but maybe that's an issue for a separate ticket.

[zarvox]

So, PHP apps can look for _SERVER['HTTP_X_SANDSTORM_BASE_PATH'], which will be present if running under sandstorm, since we'll forward all headers that sandstorm-http-bridge passes on.

I've a patch forthcoming that does the appropriate thing for the embedded nginx, so it php5-fpm has HTTPS set if sandstorm-http-bridge passed on X-Forwarded-Proto: https.

I've tested the CSS absolute path using _SERVER['HTTP_X_SANDSTORM_BASE_PATH'] and it seems to work correctly, so that's also good.