fix(deploy): proxy machine prefixes in split topology

[Chris0Jeky]

Summary

• Route bare machine prefixes and descendants for /api, /hubs, /health, and /mcp to the API container in both split-container nginx templates.
• Preserve forwarded headers, route-specific timeouts, and SignalR WebSocket upgrade semantics for /hubs.
• Add a static/rendered contract test that extracts the Terraform heredoc and proves parity between both proxy templates.

Implementation notes

The machine-prefix regex locations match the exact bare prefix and slash descendants while rejecting near-prefix paths such as /apix. proxy_pass http://api:8080; deliberately omits a URI component so nginx preserves each incoming path without a rewrite.

Tests

• powershell -NoProfile -ExecutionPolicy Bypass -File scripts/deploy/Test-TaskdeckReverseProxyConfig.ps1 — passed
• docker run --rm --add-host api:127.0.0.1 --add-host web:127.0.0.1 -v ${PWD}/deploy/nginx/reverse-proxy.conf:/etc/nginx/conf.d/default.conf:ro nginx:1.27-alpine nginx -t — passed
• powershell -NoProfile -ExecutionPolicy Bypass -File scripts/deploy/Test-TaskdeckTerraformBaseline.ps1 — passed for dev, staging, and prod
• git diff --check — passed

Scope and follow-ups

• No backend routing or 404/405 behavior changed.
• No PWA configuration changed.
• No canonical docs changed.

Refs #1992

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 053372a8bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Fresh fix-diff review completed for 053372a8bcc9f443204fca387dcca0b2aafe53af..09f55f9e9959b5f4d8ecd7289045a1a968f4ea72: no CRITICAL/HIGH or MEDIUM direct correctness finding.

proxy_buffering off; is scoped inside the exact /mcp location in both split templates. The contract test reads both configured blocks, extracts the Terraform heredoc, compares route-block parity, and asserts the directive; focused contract, real nginx -t, Terraform baselines, and diff check pass. A live end-to-end MCP SSE stream was not exercised.

One LOW hardening note is declined under the bounded fix budget: the directive assertion is substring-based and could theoretically accept a commented directive. That is a future test-strength issue, not a defect in the current active nginx configuration.

[Chris0Jeky]

Fresh integration review completed at a665b6ac5128dbdf1cd6c7f822ce03af138fcb7d against refreshed base 8dd03af30a66cf1197d3708cd2217255b5766569: no new CRITICAL/HIGH or MEDIUM integration defect.

The final-base diff remains limited to both split-proxy templates and their contract script. Static/rendered parity, nginx 1.27 syntax, exact/bare/descendant lowercase routing, near-prefix exclusion, path preservation, hub WebSocket headers, MCP proxy_buffering off, timeouts, and forwarded headers were rechecked. A live split-container end-to-end request/stream remains unverified; existing case parity, CI wiring, and STATUS residuals remain tracked outside this fix range.