Fix ERR_TOO_MANY_REDIRECTS: add trailingSlash:true + config-hash rebuild guard

Root cause: nginx proxy_pass adds trailing slash (→ /app/), Next.js with
basePath="/app" and trailingSlash:false (default) redirects /app/ → /app,
which loops forever through the same nginx path.

Fix 1 (Dockerfile): add `trailingSlash: true` to next.config.js patch so
/app/ becomes the canonical form — nginx always sends it, Next.js serves
directly with no redirect.

Fix 2 (start.sh): hash next.config.js at startup and compare against
.next/.config-hash written after each frontend build. If the hash differs
(new image with patched config) the frontend is rebuilt even when .next
is restored from the HF Dataset backup. Without this, the old .next built
with trailingSlash:false would be reused after the next restore.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -53,11 +53,12 @@ RUN git clone --depth=1 --branch v2.11.3 https://github.com/gitroomhq/postiz-app
 #   4. swcMinify: false  → Terser (pure JS) instead of native SWC binary;
 #      avoids extra RSS outside the V8 heap
 #   5. experimental.cpus=1 + workerThreads=false  → single-thread webpack
-RUN sed -i "s|const nextConfig = {|const nextConfig = {\n  basePath: '/app',\n  assetPrefix: '/app',\n  swcMinify: false,|" apps/frontend/next.config.js \
+RUN sed -i "s|const nextConfig = {|const nextConfig = {\n  basePath: '/app',\n  assetPrefix: '/app',\n  trailingSlash: true,\n  swcMinify: false,|" apps/frontend/next.config.js \
     && sed -i "s|productionBrowserSourceMaps: true|productionBrowserSourceMaps: false|" apps/frontend/next.config.js \
     && sed -i "s|disable: false,|disable: true,|" apps/frontend/next.config.js \
     && sed -i "s|experimental: {|experimental: {\n    cpus: 1,\n    workerThreads: false,|" apps/frontend/next.config.js \
     && grep -q "basePath: '/app'" apps/frontend/next.config.js \
+    && grep -q "trailingSlash: true" apps/frontend/next.config.js \
     && grep -q "productionBrowserSourceMaps: false" apps/frontend/next.config.js \
     && grep -q "swcMinify: false" apps/frontend/next.config.js \
     && grep -q "cpus: 1" apps/frontend/next.config.js \

start.sh

@@ -157,20 +157,33 @@ else
     echo "   Add HF_TOKEN as a Space secret to enable DB+uploads backup."
 fi
 
-# ── Build Next.js frontend (first boot or after a fresh deploy) ───────────────
+# ── Build Next.js frontend (first boot or after next.config.js change) ───────
 # next build is NOT run during docker build — the HF builder's ~4 GB cgroup
 # limit is less than what next build needs. We run it here where the runtime
 # has 16 GB. On subsequent starts the .next directory is restored from the
-# HF Dataset backup, so this block only executes once (or after a version bump).
+# HF Dataset backup, so this block only executes once per config version.
+#
+# Config-hash check: if next.config.js changed (new image deploy), the stored
+# hash inside .next won't match — we rebuild automatically even if BUILD_ID
+# exists. This avoids serving a .next compiled with stale settings.
 FRONTEND_NEXT="${POSTIZ_DIR}/apps/frontend/.next"
-if [ ! -f "${FRONTEND_NEXT}/BUILD_ID" ]; then
-    echo ""
-    echo "  ┌─────────────────────────────────────────────────────────────────┐"
-    echo "  │  Building Next.js frontend (first boot — takes ~5 min)          │"
-    echo "  │  Dashboard is live at ${PUBLIC_URL}/                             │"
-    echo "  │  Postiz will start automatically when the build finishes.        │"
-    echo "  └─────────────────────────────────────────────────────────────────┘"
-    echo ""
+CONFIG_HASH=$(md5sum "${POSTIZ_DIR}/apps/frontend/next.config.js" 2>/dev/null | cut -d' ' -f1 || echo "none")
+STORED_HASH=$(cat "${FRONTEND_NEXT}/.config-hash" 2>/dev/null || echo "")
+
+if [ ! -f "${FRONTEND_NEXT}/BUILD_ID" ] || [ "${CONFIG_HASH}" != "${STORED_HASH}" ]; then
+    if [ "${CONFIG_HASH}" != "${STORED_HASH}" ] && [ -f "${FRONTEND_NEXT}/BUILD_ID" ]; then
+        echo ""
+        echo "  next.config.js changed — rebuilding frontend (~5 min)..."
+        echo ""
+    else
+        echo ""
+        echo "  ┌─────────────────────────────────────────────────────────────────┐"
+        echo "  │  Building Next.js frontend (first boot — takes ~5 min)          │"
+        echo "  │  Dashboard is live at ${PUBLIC_URL}/                             │"
+        echo "  │  Postiz will start automatically when the build finishes.        │"
+        echo "  └─────────────────────────────────────────────────────────────────┘"
+        echo ""
+    fi
     cd "${POSTIZ_DIR}"
     SENTRY_DSN="" \
     SENTRY_AUTH_TOKEN="" \
@@ -181,6 +194,7 @@ if [ ! -f "${FRONTEND_NEXT}/BUILD_ID" ]; then
     NEXT_PRIVATE_SKIP_SIZE_MINIMIZATION=true \
     NODE_OPTIONS="--max-old-space-size=8192" \
     pnpm run build:frontend 2>&1 | sed 's/^/[frontend-build] /'
+    echo "${CONFIG_HASH}" > "${FRONTEND_NEXT}/.config-hash"
     echo "Frontend build complete."
     cd /
 fi