fix: patch nginx to re-add /app prefix when proxying to Next.js

health-server strips /app from /app/* requests before forwarding to nginx:5000.
Next.js is built with basePath="/app" and only handles paths at /app/*.
Without this patch: nginx sends /auth/login → Next.js 404.
With this patch: nginx sends /app/auth/login → Next.js serves the page.

Patch changes proxy_pass http://{host}:4200/ → http://{host}:4200/app/
in the upstream nginx.conf at runtime (covers both localhost and 127.0.0.1).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -119,7 +119,15 @@ RUN pip install --no-cache-dir --break-system-packages \
 COPY --from=postiz-builder /build /app
 
 # nginx.conf: routes /api→3000, /uploads→fs, /→4200.
+# Patch: re-add /app prefix before proxying to Next.js (port 4200) because:
+#   health-server strips /app from incoming /app/* requests before forwarding
+#   to nginx. Next.js is built with basePath="/app" so it expects /app/* paths.
+#   Without the patch, nginx sends /auth/login → Next.js returns 404.
+#   With the patch, nginx sends /app/auth/login → Next.js handles it correctly.
 COPY --from=postiz-builder /build/var/docker/nginx.conf /etc/nginx/nginx.conf
+RUN sed -i 's|proxy_pass http://127.0.0.1:4200/;|proxy_pass http://127.0.0.1:4200/app/;|; s|proxy_pass http://localhost:4200/;|proxy_pass http://localhost:4200/app/;|' /etc/nginx/nginx.conf \
+    && grep -q '/app/' /etc/nginx/nginx.conf \
+    || (echo "NGINX PATCH FAILED — upstream nginx.conf format changed"; cat /etc/nginx/nginx.conf; exit 1)
 
 # Health-server outside /app to avoid pnpm workspace collisions.
 RUN mkdir -p /opt/healthsrv && cd /opt/healthsrv && \