feat(portals): serve each portal with Caddy instead of nginx (refs #166)

nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver` directive and never the search domains in /etc/resolv.conf. That cost two workarounds in one script: rewriting the resolver address for rootless podman (Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff` name could resolve on Kubernetes at all. Caddy dials its upstream per request through the system resolver, which reads nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every engine with no per-engine configuration — and it still starts before the BFF exists and picks up its restarts. Both workarounds are deleted with the script. Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite every API path to /index.html before the proxy saw it.
2026-09-04 17:25:09 +02:00
parent d07aa2f64f
commit 162e495f29
22 changed files with 130 additions and 170 deletions
@@ -100,7 +100,7 @@ test('DigiD submit → public INGEDIEND → documenten → behandelaar goedkeurt
  await expect(goedkeuren).toBeVisible({ timeout: 30_000 });

  // Click and wait for the decide POST to finish (204) BEFORE leaving the page. `click()` only
-  // dispatches the request; navigating away immediately cancels it in flight (nginx logs a 499) and
+  // dispatches the request; navigating away immediately cancels it in flight (the proxy logs a client-cancelled request) and
  // the decision never reaches the domain — so the registration would stay INGEDIEND.
  const decided = staff.waitForResponse(
    (r) =>