Awesome 
The code below is working in Phoenix 1.6.6, thanks Chris and Kurt!
FYI to anyone that finds this later - the force_ssl option is a compile time config item, so can’t go in our runtime config.
config/prod.exs
config :rafo, RafoWeb.Endpoint,
...
force_ssl: [rewrite_on: [:x_forwarded_host, :x_forwarded_port, :x_forwarded_proto]]
config/runtime.exs
config :rafo, RafoWeb.Endpoint,
check_origin: :conn,
...