does anyone have an example of how you might implement a 'catch-all' rule in yada that checks for the X-Forwarded-Proto header and does the usual HTTP > HTTPS forwarding? That would be in interceptor land I guess?

Pretty much everything like that would be an interceptor

although I've ended up running nginx in front for various other reasons, so I'd probably tend to put that kind of stuff there

yes, that would be the other option. it's a bit messy though to configure nginx on elasticbeanstalk...