Add fail-safe for http->https redirect

kubernetes/dspace-ingress.yaml

@@ -2,9 +2,21 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   annotations:
-    ingress.kubernetes.io/add-base-url: "true"
+    # OAI-PMH uses HTTP transport, ie. we can't redirect *all* traffic to https.
+    # However, we need to make sure that 'our internal' nginx redirects http:// -> https://
+    # (except for /repository/oai).
     ingress.kubernetes.io/ssl-redirect: "false"
-    ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # But just to be sure, we are /also/ redirecting here.
+    ingress.kubernetes.configuration-snippet: |
+      if ($scheme = "http") {
+        set $rewrite_https 1;
+      }
+      if ($request_uri ~ "^/repository/oai") {
+        set $rewrite_https 0;
+      }
+      if ($rewrite_https = 1) {
+        return 301 https://$server_name$request_uri;
+      }
     ingress.kubernetes.io/secure-backends: "true"
   name: dspace-ingress
   namespace: dspace-dev