HTTP to HTTPS Redirect with HTTPProxy

A load balancer created with datumctl alb create forces HTTPS by default, because the command adds a redirect rule like the one on this page. An HTTPProxy that you write yourself doesn’t redirect unless you add the rule. This guide applies when you manage the HTTPProxy directly, or when you need a custom redirect — for example, from a specific path or with a different status code.The rule matches only requests whose x-forwarded-proto header is http. The load balancer listens on both HTTP and HTTPS, so a rule that matched every request would also redirect HTTPS requests to themselves.

Overview

A RequestRedirect filter responds to the client with a redirect response directly — no backend is reached. The Application Load Balancer handles the redirect at the proxy layer. At a high level, this setup:

Matches all incoming requests on a hostname
Returns a 301 Moved Permanently redirect to the same URL using https

Prerequisites

datumctl installed and authenticated
A valid Project
An existing HTTPProxy hostname, or create a new one with this guide

Configuration Steps

Step 1: Set Variables

macOS / Linux
Windows (PowerShell)

PROJECT="your-project-id"
NAMESPACE="default"
PROXY_NAME="https-redirect-demo"
HOSTNAME="your-app.example.com"

$PROJECT    = "your-project-id"
$NAMESPACE  = "default"
$PROXY_NAME = "https-redirect-demo"
$HOSTNAME   = "your-app.example.com"

Step 2: Apply the Redirect Configuration

The RequestRedirect filter requires type: RequestRedirect. No backend is needed — the redirect is returned immediately by the proxy.

macOS / Linux
Windows (PowerShell)

cat <<EOF | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -
apiVersion: networking.datumapis.com/v1alpha
kind: HTTPProxy
metadata:
  name: $PROXY_NAME
spec:
  hostnames:
  - $HOSTNAME
  rules:
  - name: https-redirect
    matches:
    - path:
        type: PathPrefix
        value: /
      headers:
      - name: x-forwarded-proto
        type: Exact
        value: http
    filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        statusCode: 301
EOF

@"
apiVersion: networking.datumapis.com/v1alpha
kind: HTTPProxy
metadata:
  name: $PROXY_NAME
spec:
  hostnames:
  - $HOSTNAME
  rules:
  - name: https-redirect
    matches:
    - path:
        type: PathPrefix
        value: /
      headers:
      - name: x-forwarded-proto
        type: Exact
        value: http
    filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        statusCode: 301
"@ | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -

Verification

Test that a plain HTTP request receives a redirect:

curl -I http://$HOSTNAME/

Expected response:

HTTP/1.1 301 Moved Permanently
Location: https://your-app.example.com/

Confirm that the Location header uses https and preserves the path.

Cleanup

macOS / Linux
Windows (PowerShell)

datumctl delete httpproxy $PROXY_NAME \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete httpproxy $PROXY_NAME `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

Troubleshooting

Symptom	Root Cause	Resolution
API rejects the resource	`type` field missing from filter	Add `type: RequestRedirect` to the filter
Redirect loop	Both HTTP and HTTPS rules redirect	Ensure the redirect rule only targets HTTP traffic
`Location` header has wrong hostname	Hostname not set	Add `hostname` to `requestRedirect` to override
Client receives `302` instead of `301`	`statusCode` is unset (the default is `302`) or set to `302`	Set `statusCode: 301` for a permanent redirect

Best Practices

Use statusCode: 301 for permanent redirects — browsers and crawlers cache these
Use statusCode: 302 only when the redirect is temporary (e.g., maintenance)
If redirecting to a different hostname, set requestRedirect.hostname explicitly rather than relying on the Host header

Summary

HTTP to HTTPS redirects use type: RequestRedirect with scheme: https
The type field is required on all filters
No backend is needed — RequestRedirect is a terminal filter that responds to the client directly
statusCode accepts 301, 302, 303, 307, or 308, and defaults to 302

Introduction

Explore

HTTP to HTTPS Redirect with HTTPProxy

Overview

Prerequisites

Configuration Steps

Step 1: Set Variables

Step 2: Apply the Redirect Configuration

Verification

Cleanup

Troubleshooting

Best Practices

Summary

​Overview

​Prerequisites

​Configuration Steps

​Step 1: Set Variables

​Step 2: Apply the Redirect Configuration

​Verification

​Cleanup

​Troubleshooting

​Best Practices

​Summary

Overview

Prerequisites

Configuration Steps

Step 1: Set Variables

Step 2: Apply the Redirect Configuration

Verification

Cleanup

Troubleshooting

Best Practices

Summary