HTTP redirecting, port forwarding, security headers questions

My question is did I redirect http to https correctly? I want to also proxy forward https to port 4000 using socket.io. Additionally, where would I put the security headers in this configuration? Is this where I’d set up the TLS? If not where would I fix the TLS? It’s in the nginx/ sites-enabled/ap.kosherup file. Can someone please help me.

 server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name api.kosherup www.api.kosherup;
    return 301 https://$host$request_uri;
 }
 server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_certificate /etc/nginx/certificate/nginx-certificate.crt;
    ssl_certificate_key /etc/nginx/certificate/nginx.key;
    add_header Strict-Transport-Security "max-age=31536000; 
    includeSubDomains";
    root /var/www/api.kosherup/html;
    index index.html index.htm index.nginx-debian.html;
    server_name api.kosherup www.api.kosherup;
    location /socket.io {
    proxy_pass http://localhost:4000/socket.io/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
 } 


}