server {
    listen private.ip:80;
    allow lb.ip;
    allow secondary_lb.ip;
    deny all;

    server_name qa.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen private.ip:443 ssl;
    allow lb.ip;
    allow secondary_lb.ip;
    deny all;

    server_name qa.example.com;

    # rest of config
}