Enforce HTTPS with VCL

enforce_https.vcl

sub vcl_recv {
    //Use req.proto instead of req.http.X-Forwarded-Proto if your varnish server isn't behind a load balancer
    if ( req.http.X-Forwarded-Proto !~ "(?i)https") {
        //The 750 number is arbitrary, you just need a unique number to check for in the vcl_synth sub
        return (synth(750, ""));
    }    
}

sub vcl_synth {
    if (resp.status == 750) {
        set resp.status = 301;
        set resp.http.Location = "https://" + req.http.host + req.url;
        return(deliver);
    }
}