From 46926215af05d4391890732ce211c0d71a080991 Mon Sep 17 00:00:00 2001
From: Edwin van den Houdt <eho@respellion.nl>
Date: Fri, 31 Jul 2026 09:33:49 +0200
Subject: [PATCH] fix(proxy): preserve the client-facing port in the /portal
 redirect

`return 301 /portal/` let nginx build the Location header from its
own internal `listen 80`, dropping the host's published port (e.g.
:8080) entirely - a browser hitting bare "http://host:8080/portal"
got redirected to "http://host/portal/" (port 80) and failed to
connect. Using $http_host keeps the port the client actually used.
---
 proxy/nginx.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/proxy/nginx.conf b/proxy/nginx.conf
index 6439c2a..d3d9740 100644
--- a/proxy/nginx.conf
+++ b/proxy/nginx.conf
@@ -32,8 +32,12 @@ http {
     # "/" -> new-frontend block below); the bare-path redirect below only
     # exists to catch "/portal" (no trailing slash), which wouldn't match
     # "location /portal/" and would otherwise silently fall through to "/".
+    # $http_host (not $host) is used explicitly so the Location header keeps
+    # the client-facing port (e.g. :8080) - nginx's own implicit redirect
+    # construction uses its internal `listen` port instead, which silently
+    # drops the port the host actually published this container under.
     location = /portal {
-      return 301 /portal/;
+      return 301 $scheme://$http_host/portal/;
     }
 
     location /portal/ {