nginx-ssl.conf

server {
  listen       443 ssl;
  listen       [::]:443 ipv6only=on ssl;
  # .. other stuff like your ssl config here
  location / {
    add_header Strict-Transport-Security "max-age=3600";
    # ABOVE FOR TESTING ONLY - once you're happy, use a longer policy time eg
    # add_header Strict-Transport-Security max-age=86400;
    proxy_set_header "X-Forwarded-For" $proxy_add_x_forwarded_for;
    proxy_set_header "X-Forwarded-Proto" https;
    # ... other proxy headers etc
}

site.vcl

sub vcl_recv {
  if ( req.http.X-Forwarded-Proto !~ "(?i)https") {
    set req.http.X-Redir-Url = "https://" + req.http.Host + req.url;
    error 750 req.http.X-Redir-Url;
  }
}
sub vcl_error {
  if (obj.status == 750) {
    set obj.http.Location = obj.response;
    set obj.status = 301;
    return (deliver);
  }
}