Fix url scheme by passing in ----forwarded-allow-ips='*'

Otherwise header information from the unix socket isn't trusted
(https://github.com/encode/uvicorn/blob/master/docs/deployment.md#running-behind-nginx).
You'll notice for instance that the redirect to the welcome page points
to the default http scheme, because X-Forward-Proto is not trusted.

doc/source/admin/nginx.md

@@ -118,9 +118,13 @@ http {
         # Enable HSTS
         add_header Strict-Transport-Security "max-age=15552000; includeSubdomains";
 
-        # proxy all requests not matching other locations to uWSGI
+        # proxy all requests not matching other locations to Gunicorn
         location / {
-            proxy_pass http://unix:/srv/galaxy/var/uwsgi.sock;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_pass http://unix:/srv/galaxy/var/gunicorn.sock;
         }
 
         # serve framework static content
@@ -184,9 +188,13 @@ previous section:
     ```nginx
             #...
 
-            # proxy all requests not matching other locations to uWSGI
+            # proxy all requests not matching other locations to Gunicorn
             location /galaxy {
-                proxy_pass http://unix:/srv/galaxy/var/uwsgi.sock;
+                proxy_set_header Host $http_host;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_pass http://unix:/srv/galaxy/var/gunicorn.sock:/galaxy;
             }
 
             # serve framework static content
@@ -208,10 +216,10 @@ previous section:
     gravity:
       gunicorn:
         # ...
-        bind: /srv/galaxy/var/uwsgi.sock
+        bind: /srv/galaxy/var/gunicorn.sock
     galaxy:
         # ...
-        galaxy_url_prefix: /prefix
+        galaxy_url_prefix: /galaxy
         # ...
     ```
 
@@ -479,8 +487,6 @@ subject](http://galacticengineer.blogspot.com/2015/06/exposing-galaxy-reports-vi
 After successfully following the blog post, Galaxy reports should be available at e.g. `https://galaxy.example.org/reports`.
 To secure this page to only Galaxy administrators, adjust your nginx config accordingly:
 
-**TODO:** This is not valid for the uWSGI proxy method and needs to be updated. -nate 2018-01-11
-
 ```nginx
         location /reports {
             #...

doc/source/admin/scaling.md

@@ -210,11 +210,14 @@ gravity:
   app_server: gunicorn
   gunicorn:
     # listening options
-    bind: '/srv/galaxy/var/gunicorn.sock'
+    bind: 'unix:/srv/galaxy/var/gunicorn.sock'
+    gunicorn_extra_args: '--forwarded-allow-ips="*"'
 ```
 
 Here we've used a UNIX domain socket because there's less overhead than a TCP socket and it can be secured by filesystem
-permissions, but you can also listen on a port:
+permissions. Note that we've added `--forwarded-allow-ips="*"` to ensure that the domain socket is trusted as a source from which to proxy headers.
+
+You can also listen on a port:
 
 ```yaml
   app_server: gunicorn
@@ -223,6 +226,8 @@ permissions, but you can also listen on a port:
     bind: '127.0.0.1:4001'
 ```
 
+If you are listening on a port do not set `--forwarded-allow-ips="*"`.
+
 The choice of port 4001 is arbitrary, but in both cases, the socket location must match whatever socket the proxy server
 is configured to communicate with. If using a UNIX domain socket, be sure that the proxy server's user has read/write
 permission on the socket. Because Galaxy and the proxy server most likely run as different users, this is not likely to
@@ -241,10 +246,12 @@ gravity:
   app_server: gunicorn
   gunicorn:
     # listening options
-    bind: '/srv/galaxy/var/gunicorn.sock'
-    gunicorn_extra_args: '--bind 127.0.0.1:8080'
+    bind: 'unix:/srv/galaxy/var/gunicorn.sock'
+    gunicorn_extra_args: '--forwarded-allow-ips="*" --bind 127.0.0.1:8080'
 ```
 
+Note that should only be used for debugging purposes due to `--forwarded-allow-ips="*"`.
+
 **Without a proxy server**:
 
 It is strongly recommended to use a proxy server.