feat(orchestrator): complete container migration and release hardening

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -31,15 +31,15 @@ export const APP_PORTS: Record<string, number> = {
   'immich':        2283,
   'immich_server': 2283,
   'filebrowser':   8083,
-  'nginx-proxy-manager': 8181,
+  'nginx-proxy-manager': 81,
+  'gitea':         3001,
   'portainer':     9000,
-  'uptime-kuma':   3001,
+  'uptime-kuma':   3002,
   'fedimint':      8175,
   'fedimintd':     8175,
   'fedimint-gateway': 8176,
   'indeedhub':     7778,
   'botfights':     9100,
-  'gitea':         3000,
   'dwn':           3100,
   'endurain':      8080,
 }
@@ -47,7 +47,11 @@ export const APP_PORTS: Record<string, number> = {
 /** Apps that need nginx proxy for iframe embedding.
  *  IndeedHub loads via /app/indeedhub/ proxy for nostr-provider.js injection
  *  from the container's internal nginx so iframe works on all servers. */
-export const PROXY_APPS: Record<string, string> = {}
+export const PROXY_APPS: Record<string, string> = {
+  'gitea': '/app/gitea/',
+  'nginx-proxy-manager': '/app/nginx-proxy-manager/',
+  'uptime-kuma': '/app/uptime-kuma/',
+}
 
 /** Nginx proxy paths -- used on HTTPS to avoid mixed content (HTTPS parent + HTTP port iframe).
  *  On HTTP, direct port access is used instead (faster, no proxy). */
@@ -121,42 +125,24 @@ export const NEW_TAB_APPS = new Set([
   'portainer',
   'onlyoffice',
   'nginx-proxy-manager',
+  'gitea',
   'tailscale',
 ])
 
 /** Sites known to block iframes -- skip the timeout and go straight to fallback */
 export const IFRAME_BLOCKED_APPS = new Set<string>([])
 
-/** Resolve the app URL given its ID and current route query */
+/** Resolve app URL using direct port mapping (source of truth) */
 export function resolveAppUrl(id: string, routeQueryPath?: string): string {
   // External HTTPS apps
   const ext = EXTERNAL_URLS[id]
   if (ext) return ext
 
-  // Apps that need nginx proxy (nostr-provider.js injection for NIP-07)
-  const proxyPath = PROXY_APPS[id]
-  if (proxyPath) return `${window.location.origin}${proxyPath}`
-
-  // IndeedHub: direct port access (nostr-provider.js baked into container image)
-  if (id === 'indeedhub') {
-    const port = APP_PORTS[id]
-    if (port) {
-      let base = `${window.location.protocol}//${window.location.hostname}:${port}`
-      if (routeQueryPath) base += routeQueryPath
-      return base
-    }
-  }
-
-  // HTTPS: use nginx proxy to avoid mixed content
-  if (window.location.protocol === 'https:') {
-    const httpsProxy = HTTPS_PROXY_PATHS[id]
-    if (httpsProxy) return `${window.location.origin}${httpsProxy}`
-  }
-
-  // HTTP: direct port access
+  // Local apps: always launch by host port
   const port = APP_PORTS[id]
   if (!port) return ''
-  let base = `http://${window.location.hostname}:${port}`
+
+  let base = `${window.location.protocol}//${window.location.hostname}:${port}`
   if (routeQueryPath) base += routeQueryPath
   return base
 }