fix: Fixed api url on web

deploy/chart/vantage/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: vantage
 description: Helm chart for the Vantage stack (Redis, MongoDB, guacd, server, web)
 type: application
-version: 1.0.8
+version: 1.1.0
 appVersion: "1.0.8"

deploy/chart/vantage/templates/NOTES.txt

@@ -41,12 +41,9 @@ Ingress (Traefik):
 {{- range .Values.ingress.web.extraHosts }}
                  https://{{ . }}
 {{- end }}
-{{- if .Values.ingress.api.enabled }}
-    {{ join ", " .Values.ingress.api.paths }} go straight to the server; everything else to web.
-{{- else }}
-    Everything goes to web, which proxies /api and /auth onward. Set
-    ingress.api.enabled=true to route them at the edge instead.
-{{- end }}
+    {{ join ", " .Values.ingress.api.paths }} go to the server; everything else to web.
+    web proxies nothing, so those paths must be routed here or by a terminator
+    in front of this ingress.
 {{- if .Values.ingress.grpc.enabled }}
   - Agents:      {{ .Values.ingress.grpc.host }} (gRPC, h2c behind TLS)
     Agents dial server.env.grpcHost, currently {{ tpl .Values.server.env.grpcHost . }}.

deploy/chart/vantage/templates/ingress.yaml

@@ -2,16 +2,14 @@
 {{/*
 Two hostnames, because the two audiences arrive over different protocols.
 
-Browsers reach the web host. What answers there depends on the path: with
-ingress.api.enabled, /api and /auth go straight to the server and everything
-else goes to `web`. Without it, everything goes to `web`, which proxies those
-prefixes onward itself (web/next.config.ts).
+Browsers reach the web host, and the path decides what answers: /api, /auth,
+/public, /install* and /update* go to the server, everything else to `web`.
 
-Both work. Routing at the edge is one hop shorter and is what the Nginx Proxy
-Manager deployment in front of the Docker install already does, so leaving it
-off changes the shape of the request path between the two deployments. It is
-still off by default, because turning it on where `web` is the only thing with
-a public certificate would strand /api behind a route nobody can reach.
+That split is not optional and ingress.api.enabled defaults to true. `web`
+proxies nothing — it holds no address for the server at all — so with these
+paths absent the UI loads and every request it makes 404s against Next. The
+setting remains a value only so an installation terminating in front of this
+ingress can route the prefixes itself; it must be routed somewhere.
 
 The web host is normally a wildcard — `*.vantage.example.com` — because that is
 the per-tenant instance namespace; APP_ROOT_LABEL resolves the instance from the
@@ -35,6 +33,9 @@ its HTTP port too.
 {{- if and .Values.ingress.api.enabled (not $apiPaths) }}
 {{- fail "ingress.api.enabled requires at least one path in ingress.api.paths" }}
 {{- end }}
+{{- if not .Values.ingress.api.enabled }}
+{{- fail "ingress.api.enabled=false leaves /api, /auth and /public unrouted: web proxies nothing. Route those prefixes to the server at your own terminator, or leave this enabled." }}
+{{- end }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

deploy/chart/vantage/templates/web.yaml

@@ -38,12 +38,10 @@ spec:
           image: "{{ .Values.web.image.repository }}:{{ .Values.web.image.tag }}"
           ports:
             - containerPort: {{ .Values.web.service.port }}
-          env:
-            - name: API_URL
-              value: {{ tpl .Values.web.env.apiUrl . | quote }}
-          # /healthz is served by this Next process; /api is rewritten to the
-          # server, so a probe there would report the backend's health and keep
-          # passing while this pod was wedged.
+          # /healthz is served by this Next process. /api never reaches this
+          # pod at all — the ingress routes it to the server — so there is no
+          # backend address to configure and no probe here that could report
+          # the backend's health by accident.
           startupProbe:
             httpGet:
               path: /healthz

deploy/chart/vantage/values.yaml

@@ -79,8 +79,6 @@ web:
     service:
         type: ClusterIP
         port: 3000
-    env:
-        apiUrl: "http://{{ .Release.Name }}-server:8080"
 
 ingress:
     enabled: false
@@ -90,8 +88,10 @@ ingress:
     web:
         host: ""
         extraHosts: []
+    # Not optional: web proxies nothing, so these prefixes reach the server
+    # only through this ingress. Turning it off serves the UI with a dead API.
     api:
-        enabled: false
+        enabled: true
         paths:
             - /api/
             - /auth/

deploy/docker/docker-compose.yml

@@ -60,8 +60,10 @@ services:
         restart: unless-stopped
         ports:
             - 3000:3000
-        environment:
-            API_URL: ${API_URL:-http://server:8080}
+        # No API_URL: web proxies nothing. The reverse proxy in front of this
+        # deployment must route /api, /auth, /public, /install*, /update* to
+        # server:8080 and everything else to web:3000. Reaching web:3000
+        # directly serves the UI and every API call 404s.
         depends_on:
             - server
 volumes: