Setting up SSL for One-Click Wordpress Droplet with Let's Encrypt and Nginx

I have a somewhat working configuration going on. The idea is to use one of my Ubuntu 16.04 instances as a load balancer with nginx to redirect traffic to the WordPress instance I have with a Let’sEncrypt SSL cert. I believe the nginx config below is working, I can see the address bar changes to https://www.domain.io.

The problem is that the page resources are still being requested over http which logs an error on the browser console: Mixed Content: The page at 'https://www.domain.io/' was loaded over HTTPS, but requested an insecure script....

Another problem is that if I set the WordPress values of WP_HOME and WP_SITEURL to https://www.domain.io, accessing the admin panel on /wp-admin causes a 307 Internal Redirect to http://www.domain.io which creates a non-stop loop.

How do I go about making sure Wordpress is set to request everything in https?

Below is my nginx block, running nginx -t shows no error. Is there something I’m missing?

server {
        listen 80;
        server_name domain.io www.domain.io;
        return 301 https://www.domain.io$request_uri;
}

server {
        listen 443;
        server_name domain.io;

        # ...
        # SSL stuff removed for brevity
        # ...

        return 301 https://www.domain.io$request_uri;
}

server {
        listen 443 ssl;
        server_name domain.io www.domain.io;

        # ...
        # SSL stuff removed for brevity
        # ...

        location / {
                proxy_pass http://<Private IP of Wordpress Instance>;
                #proxy_set_header Host $host;
                #proxy_set_header X-Real-IP $remote_addr;
                #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                #proxy_set_header X-Forwarded-Proto $scheme;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
        }

}