Proxy Opportunities through the apex host

[jmgasper]

What changed

• proxies /opportunities and child routes from the Topcoder apex host to Platform UI
• proxies the root-relative /static tree and exact public shell assets on the apex host
• canonicalizes www .../opportunities to the apex while preserving legacy www /static behavior
• connects directly to the configured CloudFront distribution while retaining Platform UI TLS SNI and Host
• validates ENV_PLATFORM_UI_ORIGIN and the scoped ENV_PLATFORM_UI_RESOLVER AmazonProvidedDNS address
• documents the ALB forwarding and Fargate resolver contracts

Why

The prior ALB rule redirected the browser to platform-ui.topcoder-dev.com. Serving through the root nginx proxy keeps topcoder-dev.com/opportunities visible. A scoped VPC resolver is required because the legacy global nginx resolvers are unreachable from the Fargate subnet.

Validation

• bash -n build buildimage.sh
• malformed resolver and origin fail-closed checks
• generated dev configuration nginx -t passed in the deployed nginx runtime
• linux/amd64 Docker build passed
• header-gated live proxy tests matched Platform UI bytes for list, challenge, and review routes
• JS, CSS, lazy chunks, manifest, favicon, logo, and global CSS returned correct MIME types and bodies
• headless Chromium rendered the Opportunities page at the apex URL
• www child route performs one redirect to the apex and preserves query strings
• exact-boundary /opportunities-old and unrelated apex routing remain unchanged
• git diff --check

Dev deployment

• nginx ECS task definition nginx-supply-task:206, rollout completed
• image digest sha256:19eac66b72c5e54d2dbe52d6fb7e05cb4b4b7c910e9f665e2752772f1678a586
• ALB rule priority 41 retains its original host/path conditions and now forwards to the established nginx target-group pair
• rollback targets remain task definition 205/204 and the captured original 302 rule action