include Rack::SSL to upgrade all requests to ssl

Gemfile

@@ -32,6 +32,7 @@ group :production do # we don't install these on travis to speed up test runs
   gem 'newrelic_rpm'
   gem 'rack-google-analytics', :require => 'rack/google-analytics'
   gem 'rack-piwik', :require => 'rack/piwik'
+  gem 'rack-ssl', :require => 'rack/ssl'
 end
 
 # configuration

Gemfile.lock

@@ -293,6 +293,8 @@ GEM
     rack-mount (0.6.14)
       rack (>= 1.0.0)
     rack-piwik (0.1.2)
+    rack-ssl (1.3.2)
+      rack
     rack-test (0.5.7)
       rack (>= 1.0)
     rails (3.0.11)
@@ -473,6 +475,7 @@ DEPENDENCIES
   pg
   rack-google-analytics
   rack-piwik
+  rack-ssl
   rails (= 3.0.11)
   rails-i18n
   redcarpet (= 2.0.1)

config/environments/production.rb

@@ -37,6 +37,9 @@ Diaspora::Application.configure do
   # In production, Apache or nginx will already do this
   config.serve_static_assets = false
 
+  #force ssl in production
+  config.middleware.insert_before ActionDispatch::Static, "Rack::SSL"
+
   # Enable serving of images, stylesheets, and javascripts from an asset server
   # config.action_controller.asset_host = "http://assets.example.com"