The portal reverse proxies hardcoded Docker's embedded DNS (resolver 127.0.0.11); on rootless
podman the DNS is network-specific (aardvark), so every proxied BFF call 502'd. Add an
/docker-entrypoint.d hook that rewrites the resolver from the container's /etc/resolv.conf at
startup — a no-op on Docker (nameserver IS 127.0.0.11), correct on podman. Verified: the built
image rewrites to 10.89.0.1 and /behandel/werkbak proxies to the BFF (401, not 502).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The app loads /config.json at startup (main.ts) so the OIDC authority is set per
environment from one build; appConfig becomes a factory and derives redirectUrl +
secureApiOrigin from the app origin (same-origin as the BFF). A multi-stage
Dockerfile builds the app and serves it via nginx, reverse-proxying /self-service
+ /openbaar to the bff (relative URLs → no CORS); nginx resolves the BFF at request
time. The compose image bakes config.json with the keycloak:8080 authority so the
browser's token issuer matches the BFF (ADR-0010).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
