Repository: caddyserver/caddy (language: go)

Issue:
caddy 2.6.1: caddy reverse-proxy --to https:// uses HTTP for upstream connection
Using the `caddy reverse-proxy` command with version `2.6.1` (`caddy/2.6.1-alpine` specifically, didn't test anything in between), upstream servers are contacted via `HTTP`, despite using `https://` scheme for `--to`.

I made a quick `docker-compose.yml` to demonstrate the issue:
```yml
---
services:
  backend:
    image: caddy:2.6.1-alpine
    ports:
      - 8443:8443
    volumes:
      - ./backend:/etc/caddy/Caddyfile
  proxy252:
    image: caddy:2.5.2-alpine
    command: caddy reverse-proxy --from https://localhost --to 'https://backend:8443' --change-host-header --insecure
    ports:
      - 8252:443
  proxy261:
    image: caddy:2.6.1-alpine
    command: caddy reverse-proxy --debug --from https://localhost --to 'https://backend:8443' --change-host-header --insecure
    ports:
      - 8261:443
```
`backend` Caddyfile:
```Caddyfile
{
	debug
}
backend:8443 {
	tls internal
	respond "Hi!"
}
``` 
```shell
docker-compose up -d
```
```shell
curl -k https://localhost:8252 # version 2.5.2
Hi!
```
```shell
curl -k https://localhost:8261 # version 2.6.1
Client sent an HTTP request to an HTTPS server.
```
Here's the corresponding log from `2.6.1`
```json
{
  "level": "debug",
  "ts": 1664278175.6793349,
  "logger": "http.handlers.reverse_proxy",
  "msg": "upstream roundtrip",
  "upstream": "backend:8443",
  "duration": 0.001320639,
  "request": {
    "remote_ip": "10.89.0.3",
    "remote_port": "58850",
    "proto": "HTTP/2.0",
    "method": "GET",
    "host": "backend:8443",
    "uri": "/",
    "headers": {
      "X-Forwarded-Host": [
        "localhost:8261"
      ],
      "User-Agent": [
        "curl/7.84.0"
      ],
      "Accept": [
        "*/*"
      ],
      "X-Forwarded-For": [
        "10.89.0.3"
      ],
      "X-Forwarded-Proto": [
        "https"
      ]
    },
    "tls": {
      "resumed": false,
      "version": 772,
      "cipher_suite": 4865,
      "proto": "h2",
      "server_name": "localhost"
    }
  },
  "headers": {},
  "status": 400
}
```


Discussion / hints:
I tried bisecting the issue and it points to e338648fed3263200dfd6abc9f8100c6f1c0eb67

https://github.com/caddyserver/caddy/blob/e338648fed3263200dfd6abc9f8100c6f1c0eb67/modules/caddyhttp/reverseproxy/command.go#L117-L119
This looks funny. Should probably be 
```go
if scheme != "" && toScheme == "" {
```

Fix patch:
diff --git a/modules/caddyhttp/reverseproxy/command.go b/modules/caddyhttp/reverseproxy/command.go
index 481f6e00d49..1b630861596 100644
--- a/modules/caddyhttp/reverseproxy/command.go
+++ b/modules/caddyhttp/reverseproxy/command.go
@@ -117,7 +117,7 @@ func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
 		if err != nil {
 			return caddy.ExitCodeFailedStartup, fmt.Errorf("invalid upstream address %s: %v", toLoc, err)
 		}
-		if scheme != "" && toScheme != "" {
+		if scheme != "" && toScheme == "" {
 			toScheme = scheme
 		}
 		toAddresses[i] = addr


Test patch: