Dev: unify local ports behind single nginx proxy

[moodyjmz]

Currently the dev stack exposes two ports — Nextcloud on :8081 and EuroOffice DocumentServer on :8080. This creates a cross-origin iframe, which among other things causes iOS Safari to block keyboard input inside the editor (iOS enforces stricter keyboard policies for cross-origin frames).

Production always proxies EuroOffice through the same Nextcloud origin, so the dev environment doesn't match prod.

Proposed change

Add a lightweight nginx container that sits in front of both services on a single port:

• /ds/* → EuroOffice DocumentServer (internal only, no external port)
• /* → Nextcloud (internal only, no external port)

Everything exposed on :8081. Same-origin by default for all contributors.

What changes

• develop/docker-compose.yml — add nginx service, remove external ports from eo and nextcloud
• develop/setup/nginx-proxy.conf — new file, simple location-based routing with X-Forwarded-Prefix: /ds
• develop/Makefile — refresh-urls sets DocumentServerUrl to http://<ip>:8081/ds and DocumentServerInternalUrl to http://eo
• Remove develop/setup/eo-proxy.conf (temporary workaround, superseded)

Benefits

• iOS keyboard works out of the box — no manual proxy setup for contributors
• make mobile / make refresh-urls workflow unchanged
• Matches production topology
• Android emulator, LAN devices, desktop all unaffected (same port, same flow)

Breaking

Existing dev installs need make wipe-nc && make local after pulling the change.

Branch: feat/single-origin-dev-proxy

---

Created with Claude Code

[moodyjmz]

Dev Topology: Single-Origin nginx Proxy

Status: planned — not yet implemented

Problem

In local dev, EuroOffice DocumentServer runs on :8080 and Nextcloud on :8081.
Different ports = different origin. iOS Safari blocks keyboard input in cross-origin
iframes, so the iOS keyboard fix only works if both services share the same origin.

The current workaround (Apache proxy in the nextcloud container, configured via
docker exec in refresh-urls) is fragile:

• Does not survive docker compose down + up (Apache modules reset)
• Requires manual occ config changes after every wipe
• Dev topology does not match production (where EuroOffice is always proxied through NC)

Solution: nginx reverse proxy container

Add a lightweight nginx service to docker-compose.yml that serves everything on a
single port. EuroOffice loses its external port — only accessible via Docker network.

            :8081
              │
           [nginx]
          /        \
  /ds/* → [eo]   /* → [nextcloud]

All devices (iOS, Android, emulator, desktop) hit one URL. Same-origin by design.
No configuration steps. Matches production topology.

Files to change

1. develop/docker-compose.yml

services:
  nginx:
    image: nginx:alpine
    container_name: eo-nginx
    ports:
      - "8081:80"           # single external port — replaces nextcloud's :8081
    volumes:
      - ./setup/nginx-proxy.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - nextcloud
      - eo

  eo:
    # remove ports: "8080:80" — no longer exposed externally
    # everything else unchanged

  nextcloud:
    # remove ports: "8081:80" — nginx now owns :8081
    # everything else unchanged

2. develop/setup/nginx-proxy.conf (new file)

server {
    listen 80;

    # EuroOffice DocumentServer — same-origin /ds/ prefix
    location /ds/ {
        proxy_pass http://eo/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Prefix /ds;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Nextcloud
    location / {
        proxy_pass http://nextcloud/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
        proxy_connect_timeout 3600;
        client_max_body_size 0;
    }
}

3. develop/Makefile — refresh-urls target

Change the DocumentServerUrl and add DocumentServerInternalUrl:

# Before:
echo "Setting DocumentServerUrl to http://$$target:8080/"; \
docker compose exec -T -u www-data nextcloud ./occ config:app:set eurooffice DocumentServerUrl --value="http://$$target:8080/" >/dev/null 2>&1; \

# After:
echo "Setting DocumentServerUrl to http://$$target:8081/ds/"; \
docker compose exec -T -u www-data nextcloud ./occ config:app:set eurooffice DocumentServerUrl --value="http://$$target:8081/ds" >/dev/null 2>&1; \
docker compose exec -T -u www-data nextcloud ./occ config:app:set eurooffice DocumentServerInternalUrl --value="http://eo" >/dev/null 2>&1; \

Also update the refresh-urls healthcheck for eo — currently uses
docker compose exec -T eo curl -sf http://localhost/healthcheck which runs inside
the eo container and is unaffected by removing the external port. No change needed.

4. Delete develop/setup/eo-proxy.conf

The Apache proxy workaround is superseded by this change. Remove it and revert the
DocumentServer main commit that added it.

Breaking change

Users with an existing setup need:

make wipe-nc    # wipe Nextcloud data
make local      # or: make mobile

This is expected — the compose topology change requires a fresh stack.

Device testing (no changes needed)

Device	URL	Notes
Desktop browser	http://localhost:8081/	unchanged
iOS/Android on LAN	http://<lan-ip>:8081/	make mobile auto-detects LAN IP
Android emulator	http://10.0.2.2:8081/	already in NEXTCLOUD_TRUSTED_DOMAINS

make mobile and make refresh-urls work identically — they detect the LAN IP,
set trusted_domains, and set DocumentServerUrl. Only the URL value changes
(:8080/ → :8081/ds).

Branch name suggestion

feat/single-origin-dev-proxy