nextlevelbuilder · keithy · Apr 12, 2026 · Apr 20, 2026 · May 12, 2026 · May 13, 2026
diff --git a/compose.d/.gitkeep b/compose.d/.gitkeep
diff --git a/compose.d/00-goclaw.yml b/compose.d/00-goclaw.yml
diff --git a/compose.options/11-postgres.yml b/compose.options/11-postgres.yml
diff --git a/compose.options/12-selfservice.yml b/compose.options/12-selfservice.yml
diff --git a/compose.options/13-upgrade.yml b/compose.options/13-upgrade.yml
diff --git a/compose.options/14-browser.yml b/compose.options/14-browser.yml
diff --git a/compose.options/15-otel.yml b/compose.options/15-otel.yml
diff --git a/compose.options/16-redis.yml b/compose.options/16-redis.yml
diff --git a/compose.options/17-sandbox.yml b/compose.options/17-sandbox.yml
diff --git a/compose.options/18-tailscale.yml b/compose.options/18-tailscale.yml
diff --git a/docker-compose.selfservice.yml b/docker-compose.selfservice.yml
@@ -18,6 +18,10 @@ services:
       dockerfile: Dockerfile
     ports:
       - "${GOCLAW_UI_PORT:-3000}:80"
+    environment:
+      # Use nginx's built-in local resolver mechanism (reads /etc/resolv.conf automatically)
+      # Works with Docker (127.0.0.11) and Podman (gateway IP) without overrides
+      - NGINX_ENTRYPOINT_LOCAL_RESOLVERS=1
     networks:
       - default
       - goclaw-net

diff --git a/ui/web/Dockerfile b/ui/web/Dockerfile
@@ -22,8 +22,8 @@ FROM nginx:1.27-alpine
 # regardless of pnpm's build-time umask (see #761).
 COPY --chmod=0755 --from=builder /app/dist /usr/share/nginx/html
 
-# Copy nginx config
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+# Copy nginx config template (envsubst-processed at startup via NGINX_ENTRYPOINT_LOCAL_RESOLVERS)
+COPY nginx.conf.template /etc/nginx/templates/default.conf.template
 
 EXPOSE 80
 

diff --git a/ui/web/nginx.conf → ui/web/nginx.conf.template b/ui/web/nginx.conf → ui/web/nginx.conf.template
@@ -10,10 +10,9 @@ server {
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
     gzip_min_length 256;
 
-    # Docker internal DNS resolver — re-resolves upstream when backend
-    # container restarts with a new IP (prevents stale DNS cache).
-    # Note: valid=10s means up to 10s stale DNS on backend restart.
-    resolver 127.0.0.11 valid=10s ipv6=off;
+    # DNS resolver — uses NGINX_LOCAL_RESOLVERS (set by nginx entrypoint from /etc/resolv.conf)
+    # Works for both Docker (127.0.0.11) and Podman (gateway IP) without manual config
+    resolver ${NGINX_LOCAL_RESOLVERS} valid=10s ipv6=off;
     set $upstream_backend "http://goclaw:18790";
 
     # Cache static assets