From 68b069dc9c7cacd209ae97756f37550fa3b4093b Mon Sep 17 00:00:00 2001
From: stroblme <stroblme@posteo.de>
Date: Wed, 14 Oct 2026 23:24:32 +0200
Subject: [PATCH] LAN proxy: serve /hooks next to /api, so webhooks and served
 sockets reach the backend instead of the SPA

---
 docker/compose.lan.yml      |  3 ++-
 docker/nginx-api-proxy.conf | 10 +++++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/docker/compose.lan.yml b/docker/compose.lan.yml
index 6dcea53..5b2eba6 100644
--- a/docker/compose.lan.yml
+++ b/docker/compose.lan.yml
@@ -3,7 +3,8 @@
 # For reaching the app from a machine that cannot be given a DNS record or a
 # hosts entry. Traefik routes on the Host header and a bare IP matches no
 # router, so the frontend is published on a host port instead and proxies the
-# API on that same port: http://<host-ip>:${APP_PORT} is the whole app.
+# API and the hooks on that same port: http://<host-ip>:${APP_PORT} is the
+# whole app.
 services:
 
   frontend:
diff --git a/docker/nginx-api-proxy.conf b/docker/nginx-api-proxy.conf
index 1c36445..b09b499 100644
--- a/docker/nginx-api-proxy.conf
+++ b/docker/nginx-api-proxy.conf
@@ -4,7 +4,10 @@
 # client asks for /api/v1/... on whatever origin served it, and never needs a
 # resolvable api.${DOMAIN} or a CORS allowance.
 
-location /api {
+# /hooks is where the flows' webhooks and served sockets live, next to the API
+# on the backend. One regex takes both, and a regex outranks `location /`,
+# which would otherwise answer /hooks with the SPA.
+location ~ ^/(api|hooks) {
     # Docker's embedded DNS, re-resolved: nginx otherwise pins the backend's
     # address at startup and 502s for good once that container is recreated.
     resolver 127.0.0.11 valid=10s ipv6=off;
@@ -18,8 +21,9 @@ location /api {
     # header naively would take it for the caller.
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
-    # The flow websocket (/api/v1/flows/ws) upgrades through here; passing the
-    # client's own Connection header covers both it and ordinary requests.
+    # The flow websocket (/api/v1/flows/ws) and a served socket upgrade through
+    # here; passing the client's own Connection header covers both and
+    # ordinary requests.
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $http_connection;
     # A live socket outlives the 60s default by design.