There should be a Boolean flag `httpsOnly` in the domain declaration, default false, which redirects any connections on HTTP to HTTPS. Relevant stack overflow: https://serverfault.com/a/250488