Merge branch 'develop' into main

Author: drorganvidez

docker/nginx/nginx.dev.conf

@@ -1,21 +1,24 @@
 events {}
 
 http {
-
-    upstream web {
-        server web:5000;
-    }
+    # Docker's embedded DNS — see nginx.prod.conf for the full rationale.
+    # In dev this matters less (no Watchtower) but keeps both configs in
+    # sync and lets `docker compose restart web` work without having to
+    # restart nginx too.
+    resolver 127.0.0.11 ipv6=off valid=10s;
 
     server {
 
         listen 80;
 
         client_max_body_size 10000M;
 
+        set $web_upstream http://web:5000;
+
         location / {
 
             # Set proxy headers
-            proxy_pass http://web;
+            proxy_pass $web_upstream;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

docker/nginx/nginx.prod.conf

@@ -1,21 +1,34 @@
 events {}
 
 http {
-
-    upstream web {
-        server web:5000;
-    }
-
+    # Docker's embedded DNS. We point nginx at it explicitly so that
+    # upstream hostnames can be re-resolved at *request* time, not just
+    # when the config is loaded. Without this, a rolling Watchtower update
+    # replaces web_app_container with a fresh IP and nginx keeps hitting
+    # the old one until someone restarts it.
+    #
+    # `ipv6=off` avoids a gotcha on networks that advertise an IPv6 record
+    # without actually having upstream IPv6 connectivity.
+    # `valid=10s` caps the DNS cache so the next container takeover is
+    # picked up within that window.
+    resolver 127.0.0.11 ipv6=off valid=10s;
+
+    # Note: an `upstream {}` block CANNOT use `resolver` — the name is
+    # resolved once at config-parse time and cached forever. Storing the
+    # URL in a variable and interpolating it in `proxy_pass` forces nginx
+    # down the dynamic-resolution path instead.
     server {
-        
+
         listen 80;
 
         client_max_body_size 10000M;
 
+        set $web_upstream http://web:5000;
+
         location / {
 
             # Set proxy headers
-            proxy_pass http://web;
+            proxy_pass $web_upstream;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;