`return 301 /portal/` let nginx build the Location header from its own internal `listen 80`, dropping the host's published port (e.g. :8080) entirely - a browser hitting bare "http://host:8080/portal" got redirected to "http://host/portal/" (port 80) and failed to connect. Using $http_host keeps the port the client actually used.