fix: enforce HTTPS root redirect for conductor /list

[amits-2u]

Summary

This change fixes the conductor root redirect so requests to / are redirected to an explicit HTTPS URL using a configured canonical hostname instead of a relative path or request-derived host. This prevents the HTTPS to HTTP downgrade seen by security scanners.

What changed

• Added a new conductor variable: CONDUCTOR_ROOT_REDIRECT_URL.
• Updated the conductor nginx template to redirect / to {{CONDUCTOR_ROOT_REDIRECT_URL}}.
• Redirect now resolves to the canonical environment hostname:

Stage: https://masters.stage.edx.org/list/
Prod: https://masters.edx.org/list/

Why

• Security scan flagged a connection security downgrade in the redirect chain:

- https://masters.stage.edx.org/ -> http://masters.stage.edx.org/list/
- https://masters.edx.org/ -> http://masters.edx.org/list/

• This change ensures the redirect remains HTTPS end-to-end while also pinning the redirect to a known, configured hostname.

Validation

• After stage deploy, verify: curl -I https://masters.stage.edx.org/
• Expected Location header: https://masters.stage.edx.org/list/
• Confirm no HTTPS to HTTP hop in the redirect chain.

Rollout plan

• Deploy and validate in stage first.
• Keep prod pipeline paused until stage validation is complete.
• Resume prod deployment after verification.
• Merge and deploy alongside the paired edx-internal change that sets CONDUCTOR_ROOT_REDIRECT_URL for stage and prod.

---

Make sure that the following steps are done before merging:

• Have a Site Reliability Engineer review the PR if you don't own all of the services impacted.
• If you are adding any new default values that need to be overridden when this change goes live, update internal repos and add an entry to the top of the CHANGELOG.
• Performed the appropriate testing.

[Copilot]

Pull request overview

Updates the Conductor nginx site template so requests to / redirect to the Conductor root target over HTTPS, aligning root redirects with an HTTPS canonical URL.

Changes:

• Change the / location redirect to return an absolute https://… URL (instead of a path-only redirect).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.