# Resolve the effective protocol: use X-Forwarded-Proto if set
# (e.g., from proxies like Cloudflare or AWS)
# otherwise fall back to the current scheme.
map $http_x_forwarded_proto $resolved_proto {
    default $scheme;
    ~.+ $http_x_forwarded_proto;
}