> ## Documentation Index
> Fetch the complete documentation index at: https://www.datum.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Agent home for Datum, with what it is, pricing, and how to act: https://agents.datum.net
> If you can only fetch URLs: read https://www.datum.net/docs/llms.txt in full and open the most specific page for the task. Commands, limits, and field paths are on task, operations, and limits pages, not on section overviews. Pages described as "Documentation is coming soon" are placeholders.
> If you have a shell or can save files: download https://www.datum.net/docs/llms-full.txt (every page, about 740 KB) once and search it with grep, instead of fetching pages one at a time.
> datumctl describes itself: `datumctl api-resources` lists resource types and `datumctl explain <resource>` shows a schema. To act on live resources, use Datum MCP or datumctl. To search the docs, use the Docs MCP server at https://www.datum.net/docs/mcp.

# HTTP to HTTPS Redirect with HTTPProxy

> Force HTTPS by redirecting all plain HTTP requests using a RequestRedirect filter on a Datum HTTPProxy.

> [!NOTE]
>
> A load balancer created with `datumctl alb create` forces HTTPS by default, because the command adds a redirect rule like the one on this page. An `HTTPProxy` that you write yourself doesn't redirect unless you add the rule. This guide applies when you manage the `HTTPProxy` directly, or when you need a custom redirect — for example, from a specific path or with a different status code.
>
> The rule matches only requests whose `x-forwarded-proto` header is `http`. The load balancer listens on both HTTP and HTTPS, so a rule that matched every request would also redirect HTTPS requests to themselves.

***

## Overview

A `RequestRedirect` filter responds to the client with a redirect response directly — no backend is reached. The [Application Load Balancer](https://www.datum.net/docs/alb/overview.md) handles the redirect at the proxy layer.

At a high level, this setup:

1. Matches all incoming requests on a hostname
2. Returns a `301 Moved Permanently` redirect to the same URL using `https`

***

## Prerequisites

* `datumctl` installed and authenticated
* A valid **Project**
* An existing `HTTPProxy` hostname, or create a new one with this guide

***

## Configuration steps

### Step 1: Set variables

> [tab] macOS / Linux
>
> ```bash theme={null}
> PROJECT="your-project-id"
> NAMESPACE="default"
> PROXY_NAME="https-redirect-demo"
> HOSTNAME="your-app.example.com"
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> $PROJECT    = "your-project-id"
> $NAMESPACE  = "default"
> $PROXY_NAME = "https-redirect-demo"
> $HOSTNAME   = "your-app.example.com"
> ```

***

### Step 2: Apply the redirect configuration

The `RequestRedirect` filter requires `type: RequestRedirect`. No backend is needed — the redirect is returned immediately by the proxy.

> [tab] macOS / Linux
>
> ```bash theme={null}
> cat <<EOF | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -
> apiVersion: networking.datumapis.com/v1alpha
> kind: HTTPProxy
> metadata:
>   name: $PROXY_NAME
> spec:
>   hostnames:
>   - $HOSTNAME
>   rules:
>   - name: https-redirect
>     matches:
>     - path:
>         type: PathPrefix
>         value: /
>       headers:
>       - name: x-forwarded-proto
>         type: Exact
>         value: http
>     filters:
>     - type: RequestRedirect
>       requestRedirect:
>         scheme: https
>         statusCode: 301
> EOF
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> @"
> apiVersion: networking.datumapis.com/v1alpha
> kind: HTTPProxy
> metadata:
>   name: $PROXY_NAME
> spec:
>   hostnames:
>   - $HOSTNAME
>   rules:
>   - name: https-redirect
>     matches:
>     - path:
>         type: PathPrefix
>         value: /
>       headers:
>       - name: x-forwarded-proto
>         type: Exact
>         value: http
>     filters:
>     - type: RequestRedirect
>       requestRedirect:
>         scheme: https
>         statusCode: 301
> "@ | datumctl apply --project $PROJECT --namespace $NAMESPACE -f -
> ```

***

## Verification

Test that a plain HTTP request receives a redirect:

```bash theme={null}
curl -I http://$HOSTNAME/
```

Expected response:

```
HTTP/1.1 301 Moved Permanently
Location: https://your-app.example.com/
```

Confirm that the `Location` header uses `https` and preserves the path.

***

## Cleanup

> [tab] macOS / Linux
>
> ```bash theme={null}
> datumctl delete httpproxy $PROXY_NAME \
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> datumctl delete httpproxy $PROXY_NAME `
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
> ```

***

## Troubleshooting

| Symptom | Root Cause | Resolution |
| - | - | - |
| API rejects the resource | `type` field missing from filter | Add `type: RequestRedirect` to the filter |
| Redirect loop | Both HTTP and HTTPS rules redirect | Ensure the redirect rule only targets HTTP traffic |
| `Location` header has wrong hostname | Hostname not set | Add `hostname` to `requestRedirect` to override |
| Client receives `302` instead of `301` | `statusCode` is unset (the default is `302`) or set to `302` | Set `statusCode: 301` for a permanent redirect |

***

## Best practices

* Use `statusCode: 301` for permanent redirects — browsers and crawlers cache these
* Use `statusCode: 302` only when the redirect is temporary (e.g., maintenance)
* If redirecting to a different hostname, set `requestRedirect.hostname` explicitly rather than relying on the `Host` header

***

## Summary

* HTTP to HTTPS redirects use `type: RequestRedirect` with `scheme: https`
* The `type` field is required on all filters
* No backend is needed — `RequestRedirect` is a terminal filter that responds to the client directly
* `statusCode` accepts `301`, `302`, `303`, `307`, or `308`, and defaults to `302`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.