Play configurations for HTTPS only on Heroku - heroku

Question

I searched around and have found topics close to this (for example here and here) but I still can't seem to get this working so here goes.
I'm using play 2.6 and deploying to Heroku. I'd like to force the app to only use HTTPS. As the aforementioned post indicates this filter (with the proper Heoku settings) seems like it should solve my problem. But I can't seems to get it working. Basically if I do the simple setup I suggest below it doesn't redirect to https and if I try anything fancy I get errors.
I guess what I'm asking is how does one setup the Procfile, application.conf and Environment variables for the deployment to Heroku. As an FYI I'm using / I'd like to be able to use play's self signed certificates for my non production deployments in case that's causing problems.
===== For the Procfile ====
Normally a simple Procfile might look like:
web: target/universal/stage/bin/my-app -Dhttp.port=${PORT}
But without heroku I'd want to do something like this (see here)
play -Dhttp.port=disabled -Dhttps.port=443
Since Heroku sets up the port/Https automagically how do I merge these two? ie is there a heroku env var like ${HTTPS_PORT} that I should be using?
===== For the application.conf ====
Presumably we want something like this
play.filters.enabled += play.filters.https.RedirectHttpsFilter
play.filters.https.redirectEnabled = true
"play.filters.https.redirectEnabled = true" shouldn't be needed but I put it there just in case. But do I also need to specify play.filters.https.port? (see here). Something like this:
play.filters.enabled += play.filters.https.RedirectHttpsFilter
play.filters.https.redirectEnabled = true
play.filters.https.port=???
Thanks in advance.
==== Edit ===
Thanks #codefinger the answers you gave is correct. I'm going to put the details below for future reference.
As mentioned here you need to tell play to check if the request has already been secured. In this case it essentially means white listing the proxy. So the Proc file can be as simple as:
web: target/universal/stage/bin/my-app -Dhttp.port=${PORT}
But you need to enable the RedirectHttpsFilter and configure the trusted proxies. Note here I've trusted all IPs but based on your app you can restrict that (details here).
play.filters.enabled += play.filters.https.RedirectHttpsFilter
play.http.forwarded.trustedProxies=["0.0.0.0/0", "::/0"]

Answer 1

I think you'll need to enable the play.core.server.common.ForwardedHeaderHandler, which will detect the X-Forwarded-Proto header that Heroku sets.
TLS termination is handled by the Heroku router, which means all request are in plain HTTP when they reach your app. The only way for your app to tell if they are HTTP(S) is which this header.