Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

HTTPS and normal HTTP will come in through different ports, so really what you want to do is just redirect any normal HTTP requests that you want to be served over HTTPS to HTTPS. So the following:

server {
  listen                      80;
  server_name                 _;

  location / {
    rewrite ^/(pro)$ https://$host/$1;
  }
}

... should not cause a redirect loop, because it is forwarding only on :80, and it is forwarding TO :443 (which is what HTTPS requests will come in as, by default).