nginx.conf

# =====================================================================
# OpenELIS internal reverse proxy — HTTP-only build for Dokploy
#
# Dokploy's Traefik terminates public TLS (Let's Encrypt) and forwards
# plain HTTP to this container on port 80. This proxy then stitches the
# app together:  /  -> React frontend   |   /api/ -> Tomcat backend (8443).
# The nginx->backend hop stays HTTPS internally with the self-signed
# certs from the certgen service (nginx does not verify upstream certs).
# =====================================================================

worker_processes 1;

events { worker_connections 1024; }

http {
    # TLS is terminated at Traefik. Trust its X-Forwarded-Proto so the
    # app generates correct https URLs; default to https if the header
    # is missing (it will always be present in normal operation).
    map $http_x_forwarded_proto $fwd_proto {
        default $http_x_forwarded_proto;
        ""      https;
    }

    server {
        listen 80;
        server_name _;

        absolute_redirect off;

        proxy_set_header X-Forwarded-Proto  $fwd_proto;
        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header Host               $host;

        location / {
            proxy_pass       http://frontend.openelis.org;
            proxy_redirect   off;
        }

        location /api/ {
            proxy_pass         https://oe.openelis.org:8443/api/;
            proxy_redirect     off;
            proxy_set_header   Host               $host;
            proxy_set_header   X-Real-IP          $remote_addr;
            proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Host   $host;
            proxy_set_header   X-Forwarded-Proto  $fwd_proto;
        }
    }
}