fix(infra): engine-portable portal nginx resolver (closes #96) #97

Merged

not merged 2 commits from fix/portal-nginx-resolver into main 2026-07-16 14:23:41 +00:00

Conversation 0 Commits 2 Files Changed 4 +29

not commented 2026-07-16 13:43:37 +00:00

Contributor

Copy Link

What & why

Closes #96. The portal nginx configs hardcode resolver 127.0.0.11 (Docker's embedded DNS) for their variable proxy_pass to the BFF, so on rootless podman (network-specific aardvark DNS) every proxied call 502'd — the portals loaded and login worked, but no in-app data flowed.

Add a shared /docker-entrypoint.d hook (apps/portal-nginx-resolver.sh, wired into all three portal Dockerfiles) that rewrites the resolver from the container's own /etc/resolv.conf at startup: a no-op on Docker (nameserver is 127.0.0.11) and correct on podman (rewrites to e.g. 10.89.0.1). nginx.conf is unchanged (the hardcoded value is the substitution anchor).

How verified

Built the behandel image and ran it on the compose network under podman: the hook rewrote the config to resolver 10.89.0.1, and GET /behandel/werkbak proxied to the BFF returning 401 (auth), not 502. On Docker the nameserver is 127.0.0.11 so the substitution is a no-op and CI/e2e behaviour is unchanged.

## What & why Closes #96. The portal nginx configs hardcode `resolver 127.0.0.11` (Docker's embedded DNS) for their variable `proxy_pass` to the BFF, so on rootless **podman** (network-specific aardvark DNS) every proxied call 502'd — the portals loaded and login worked, but no in-app data flowed. Add a shared `/docker-entrypoint.d` hook (`apps/portal-nginx-resolver.sh`, wired into all three portal Dockerfiles) that rewrites the resolver from the container's own `/etc/resolv.conf` at startup: a **no-op on Docker** (nameserver *is* 127.0.0.11) and **correct on podman** (rewrites to e.g. 10.89.0.1). nginx.conf is unchanged (the hardcoded value is the substitution anchor). ## How verified Built the behandel image and ran it on the compose network under podman: the hook rewrote the config to `resolver 10.89.0.1`, and `GET /behandel/werkbak` proxied to the BFF returning **401** (auth), not 502. On Docker the nameserver is 127.0.0.11 so the substitution is a no-op and CI/e2e behaviour is unchanged.

not added 1 commit 2026-07-16 13:43:38 +00:00

fix(infra): portal nginx resolver works on podman too, not just Docker ... 5de2e9367d

The portal reverse proxies hardcoded Docker's embedded DNS (resolver 127.0.0.11); on rootless

podman the DNS is network-specific (aardvark), so every proxied BFF call 502'd. Add an

/docker-entrypoint.d hook that rewrites the resolver from the container's /etc/resolv.conf at

startup — a no-op on Docker (nameserver IS 127.0.0.11), correct on podman. Verified: the built

image rewrites to 10.89.0.1 and /behandel/werkbak proxies to the BFF (401, not 502).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added the type:bugarea:infra labels 2026-07-16 13:43:39 +00:00

not added 1 commit 2026-07-16 13:56:58 +00:00

Merge branch 'main' into fix/portal-nginx-resolver 417f6abfa8

not merged commit 8a537edd6c into main 2026-07-16 14:23:41 +00:00

not referenced this issue from a commit 2026-07-16 14:23:43 +00:00

fix(infra): engine-portable portal nginx resolver (closes #96) (#97)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

area:acl

area:bff

area:docs

area:domain

area:event-subscriber

area:infra

area:portal-behandel

area:portal-beheer

area:portal-openbaar

area:portal-self-service

area:projection

area:workflow

type:adr-proposal

type:bug

type:chore

type:slice

No Label area:infra type:bug

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

eho

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#97