feat: Added nginx container to docker compose file

deploy/docker/.env.example

@@ -17,4 +17,7 @@ KEY_ENCRYPTION_KEY=
 # MongoDB is bundled in this compose file. Override only to use an external DB.
 MONGO_URI=mongodb://mongo:27017/vantage
 
+# Host port the bundled nginx reverse proxy listens on (plain HTTP).
+NGINX_HTTP_PORT=80
+
 # Where workflow run logs are written inside the server container.

deploy/docker/docker-compose.yml

@@ -60,12 +60,22 @@ services:
         restart: unless-stopped
         ports:
             - 3000:3000
-        # No API_URL: web proxies nothing. The reverse proxy in front of this
-        # deployment must route /api, /auth, /public, /install*, /update* to
-        # server:8080 and everything else to web:3000. Reaching web:3000
-        # directly serves the UI and every API call 404s.
+        # No API_URL: web proxies nothing. The nginx service below routes
+        # /api, /auth, /public, /install*, /update* to server:8080 and
+        # everything else to web:3000. Reaching web:3000 directly serves the
+        # UI and every API call 404s.
         depends_on:
             - server
+    nginx:
+        image: nginx:1.29-alpine
+        restart: unless-stopped
+        ports:
+            - ${NGINX_HTTP_PORT:-80}:80
+        volumes:
+            - ./nginx/vantage.conf:/etc/nginx/conf.d/default.conf:ro
+        depends_on:
+            - server
+            - web
 volumes:
     mongo_data: null
     redis_data: null

deploy/docker/nginx/vantage.conf

@@ -0,0 +1,72 @@
+# Reverse proxy for a self-hosted Vantage install.
+#
+# One hostname, two backends: the control plane's HTTP routes go to
+# server:8080, everything else to web:3000. web proxies nothing itself, so
+# without the server locations the UI loads and every request it makes 404s.
+#
+# Plain HTTP only. Terminate TLS in front of this container, or see the
+# self-hosted install docs for a variant that terminates TLS here.
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream vantage_server {
+    server server:8080;
+    keepalive 16;
+}
+
+upstream vantage_web {
+    server web:3000;
+    keepalive 16;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    # Step imports and licence pastes are the largest request bodies.
+    client_max_body_size 10m;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host              $host;
+    proxy_set_header X-Forwarded-Host  $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Upgrade           $http_upgrade;
+    proxy_set_header Connection        $connection_upgrade;
+
+    # Control plane: REST API, auth, public status pages.
+    location ^~ /api/ {
+        proxy_pass http://vantage_server;
+
+        # The browser console is a WebSocket at /api/console/tunnel and
+        # workflow logs stream as server-sent events; neither may be buffered
+        # or cut off by a short read timeout.
+        proxy_buffering off;
+        proxy_read_timeout 1h;
+        proxy_send_timeout 1h;
+    }
+
+    location ^~ /auth/ {
+        proxy_pass http://vantage_server;
+    }
+
+    location ^~ /public/ {
+        proxy_pass http://vantage_server;
+    }
+
+    # Agent install and update scripts: /install, /install.ps1, /update,
+    # /update.ps1.
+    location ~ ^/(install|update)(\.ps1)?$ {
+        proxy_pass http://vantage_server;
+    }
+
+    # Everything else is the web UI.
+    location / {
+        proxy_pass http://vantage_web;
+    }
+}