fix: rewrite Space-host redirects to relative paths + pass x-forwarded-proto

Next.js middleware generates redirects using the public SPACE_HOST (e.g.
https://somratpro-huggingpost.hf.space/auth). The HF Spaces reverse proxy
intercepts absolute redirects to its own hostname, resolves them server-side,
and returns 200 — causing blank white page at /app/ instead of navigating.

- health-server rewriteLocation: also rewrite absolute URLs whose hostname
matches SPACE_HOST to /app-prefixed relative paths (same logic as 127.0.0.1)
so the browser (not HF proxy) handles the navigation and URL bar updates
- Dockerfile: patch nginx to pass X-Forwarded-Proto from upstream header
($http_x_forwarded_proto) instead of hardcoding $scheme=http so Next.js
builds correct https:// redirect URLs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -156,8 +156,13 @@ COPY --from=postiz-builder /build/var/docker/nginx.conf /etc/nginx/nginx.conf
 #   the bare root doesn't return an empty 200 from nginx's default handler.
 #   (health-server already short-circuits /app/ before reaching nginx, but
 #    this makes nginx self-consistent for any direct curl / health checks.)
-RUN sed -i 's|proxy_pass http://127.0.0.1:4200/;|proxy_pass http://127.0.0.1:4200/app/;|; s|proxy_pass http://localhost:4200/;|proxy_pass http://localhost:4200/app/;|' /etc/nginx/nginx.conf \
+RUN sed -i \
+      's|proxy_pass http://127.0.0.1:4200/;|proxy_pass http://127.0.0.1:4200/app/;|; \
+       s|proxy_pass http://localhost:4200/;|proxy_pass http://localhost:4200/app/;|; \
+       s|proxy_set_header X-Forwarded-Proto \$scheme;|proxy_set_header X-Forwarded-Proto \$http_x_forwarded_proto;|g' \
+      /etc/nginx/nginx.conf \
     && grep -q '/app/' /etc/nginx/nginx.conf \
+    && grep -q 'x_forwarded_proto' /etc/nginx/nginx.conf \
     || (echo "NGINX PATCH FAILED — upstream nginx.conf format changed"; cat /etc/nginx/nginx.conf; exit 1)
 
 # Health-server outside /app to avoid pnpm workspace collisions.

health-server.js

@@ -426,27 +426,36 @@ function buildProxyHeaders(headers) {
 
 function rewriteLocation(loc) {
   // Postiz's Next.js middleware redirects without the basePath prefix (/app)
-  // and may use an internal hostname (127.0.0.1:NGINX_PORT) that HF Spaces'
-  // reverse proxy blocks (returning 200 empty body instead of the redirect).
+  // and may use an internal hostname (127.0.0.1:NGINX_PORT) or the public
+  // HF Space hostname (SPACE_HOST). The HF Spaces reverse proxy intercepts
+  // absolute redirects to its own hostname — it resolves them server-side
+  // and returns 200 at the original URL (blank white page for the client).
   //
   // Normalise every Location header from the Postiz nginx proxy:
-  //   1. If it's an absolute URL to an internal host → extract the path.
+  //   1. If it's an absolute URL to an internal or own-Space host → extract path.
   //   2. If the resulting path doesn't start with /app → prepend /app.
   //
+  // This converts absolute redirects to relative ones so the browser
+  // (not HF proxy) navigates and the URL bar updates correctly.
+  //
   // Examples:
-  //   http://127.0.0.1:5000/auth/login  → /app/auth/login
-  //   http://localhost:4200/auth         → /app/auth
-  //   /auth/login                        → /app/auth/login
-  //   /app/auth/login                    → /app/auth/login  (unchanged)
-  //   https://twitter.com/oauth/...      → unchanged (external host)
+  //   http://127.0.0.1:5000/auth/login              → /app/auth/login
+  //   https://somratpro-huggingpost.hf.space/auth   → /app/auth
+  //   /auth/login                                    → /app/auth/login
+  //   /app/auth/login                                → /app/auth/login (unchanged)
+  //   https://twitter.com/oauth/...                  → unchanged (external)
   if (!loc) return loc;
+  const spaceHost = process.env.SPACE_HOST || null; // e.g. somratpro-huggingpost.hf.space
   let path = null;
   if (loc.startsWith("/")) {
     path = loc;
   } else {
     try {
       const u = new URL(loc);
-      if (/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(u.host)) {
+      if (
+        /^(127\.0\.0\.1|localhost)(:\d+)?$/.test(u.host) ||
+        (spaceHost && u.hostname === spaceHost)
+      ) {
         path = u.pathname + u.search + u.hash;
       }
     } catch {}