Nginx TLS proxy for droppy

nginx.conf

user                              http;
worker_processes                  1;
error_log                         /var/log/nginx/error.log;
events {
    worker_connections            1024;
}
http {
    include                       mime.types;
    default_type                  application/octet-stream;
    server_tokens                 off;
    sendfile                      on;
    keepalive_timeout             180;
    client_max_body_size          0;
    tcp_nodelay                   off;
    upstream node {
        server                    127.0.0.1:8989;
    }
    server {
        listen                    80;
        server_name               DOMAIN;
        return                    301 https://$host$request_uri;
    }
    server {
        listen                    443 ssl spdy;
        server_name               DOMAIN;
        access_log                /var/log/nginx/nginx.log;
        ssl_certificate           /etc/nginx/certs/DOMAIN.full.crt;
        ssl_certificate_key       /etc/nginx/certs/DOMAIN.key;
        ssl_trusted_certificate   /etc/nginx/certs/ca.all.crt;
        ssl_dhparam               /etc/nginx/certs/dhparam.pem;
        ssl_prefer_server_ciphers on;
        ssl_session_cache         shared:SSL:50m;
        ssl_session_timeout       5m;
        ssl_stapling              on;
        ssl_stapling_verify       on;
        resolver                  8.8.8.8;
        ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers               ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!CAMELLIA;
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Real-Port $remote_port;
            proxy_set_header Host $http_host;
            proxy_pass http://node/;
            proxy_redirect off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            add_header Strict-Transport-Security "max-age=31536000";
        }
    }
}

I think this line should be changed to return 301 https://$host$request_uri; as per this post.

You're right. I don't run http on my server right now, and the previous line was just copied from that exact SO thread. I remember doing it with 301 before, which is probably the right way to go about https redirection.