fix: Fixed baked api url

web/Dockerfile

@@ -14,9 +14,6 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
-ARG NEXT_PUBLIC_API_URL=http://localhost:8080
-ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
-
 # Empty default on purpose: a self-hosted install has no HQ portal, and the
 # "Managed in Vantage HQ" label falls back to plain text rather than linking
 # somewhere that does not serve them.
@@ -33,6 +30,11 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
+# Control-plane URL the Next server proxies /api, /auth and /install to. Runtime,
+# not build time: next.config.js is evaluated when server.js boots in standalone
+# mode, so this is overridable per deployment without a rebuild.
+ENV API_URL=http://localhost:8080
+
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
 

web/next.config.ts

@@ -1,6 +1,11 @@
 import type { NextConfig } from "next";
 
-const apiUrl = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:8080";
+// Read at runtime, not baked in. The rewrites below run in the Next server
+// process, never in the browser, so this never needed the NEXT_PUBLIC_ prefix
+// that pins a value into the image at build time. NEXT_PUBLIC_API_URL is still
+// honoured so an existing deployment passing it keeps working.
+const apiUrl =
+    process.env.API_URL ?? process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:8080";
 
 const nextConfig: NextConfig = {
     output: "standalone",