From f97398c83c0e452c6e294f9159c2beefc6fababa Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 23 Oct 2026 23:06:51 +0200
Subject: [PATCH] fix(nginx): proxy realtime and terminal WebSockets on the
 dashboard port

A reverse proxy that forwards only port 8000 (for example Tailscale Serve or a Cloudflare Tunnel without path rules) sent /app/ and /terminal/ws to Laravel. Proxy them to Reverb (6001) and the terminal server (6002) in the container.

Closes #11707
---
 .../etc/nginx/site-opts.d/http.conf            | 18 ++++++++++++++++++
 .../production/etc/nginx/site-opts.d/http.conf | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/docker/development/etc/nginx/site-opts.d/http.conf b/docker/development/etc/nginx/site-opts.d/http.conf
index d7855ae800..f92cd0625c 100644
--- a/docker/development/etc/nginx/site-opts.d/http.conf
+++ b/docker/development/etc/nginx/site-opts.d/http.conf
@@ -29,6 +29,24 @@ location /healthcheck {
     fastcgi_pass   127.0.0.1:9000;
 }
 
+# Proxy the realtime (Reverb) and terminal WebSockets that run in this container, so a
+# reverse proxy that forwards only this port (for example Tailscale Serve) also serves them.
+location /app/ {
+    proxy_pass http://127.0.0.1:6001;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+}
+
+location = /terminal/ws {
+    proxy_pass http://127.0.0.1:6002;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+}
+
 # Have NGINX try searching for PHP files as well
 location / {
     try_files $uri $uri/ /index.php?$query_string;
diff --git a/docker/production/etc/nginx/site-opts.d/http.conf b/docker/production/etc/nginx/site-opts.d/http.conf
index d7855ae800..f92cd0625c 100644
--- a/docker/production/etc/nginx/site-opts.d/http.conf
+++ b/docker/production/etc/nginx/site-opts.d/http.conf
@@ -29,6 +29,24 @@ location /healthcheck {
     fastcgi_pass   127.0.0.1:9000;
 }
 
+# Proxy the realtime (Reverb) and terminal WebSockets that run in this container, so a
+# reverse proxy that forwards only this port (for example Tailscale Serve) also serves them.
+location /app/ {
+    proxy_pass http://127.0.0.1:6001;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+}
+
+location = /terminal/ws {
+    proxy_pass http://127.0.0.1:6002;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+}
+
 # Have NGINX try searching for PHP files as well
 location / {
     try_files $uri $uri/ /index.php?$query_string;