From d272f44c5ad2e79cd7274053effa2f322c0b1b1d Mon Sep 17 00:00:00 2001 From: root Date: Sun, 6 Sep 2026 06:41:01 +0200 Subject: [PATCH] fix(web): disable absolute_redirect in nginx to avoid leaking internal URL nginx's default absolute_redirect guesses scheme/host/port from its own listen directive when emitting directory redirects (e.g. /blog -> /blog/). Behind a reverse proxy that terminates TLS and forwards to this container over plain HTTP (Caddy, nginx, Traefik, etc. in front), that produces a Location header like http://:3000/blog/ sent straight to real visitors instead of the public https:// URL. Setting absolute_redirect off makes nginx emit a relative redirect instead, which the browser resolves against the actual request URL. Co-Authored-By: Claude Sonnet 5 --- web/nginx.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/web/nginx.conf b/web/nginx.conf index a66ccfd7d..88170bb68 100644 --- a/web/nginx.conf +++ b/web/nginx.conf @@ -4,6 +4,12 @@ server { root /usr/share/nginx/html; index index.html index.htm; + # Caddy terminates TLS and proxies here over plain HTTP, so nginx must not + # guess scheme/port for its own directory-redirect (e.g. /blog -> /blog/): + # absolute_redirect would otherwise leak this container's internal + # http://host:3000 into the Location header sent to real visitors. + absolute_redirect off; + location / { try_files $uri $uri/ /index.html; }