ingress: reverse_proxy lacks X-Forwarded-Port — Next.js redirects leak the internal port

[MauriceDellin]

What happens

The Caddyfile template rendered by the ingress role proxies with a bare

reverse_proxy 127.0.0.1:{{ app.port }}

Caddy forwards X-Forwarded-For/Proto/Host by default, but not X-Forwarded-Port. Next.js (16) builds absolute redirect URLs from the forwarded headers and, without the port header, appends the app's internal container port. Any server-side redirect then points at e.g. https://medocs.ms:3000/de — a port only published on loopback, so the browser shows "site unreachable".

Apps without absolute redirects (plexus-ms.org) never notice; any app using i18n middleware, auth redirects, or redirect() in general breaks on its first redirect.

Fix

reverse_proxy 127.0.0.1:{{ app.port }} {
	header_up X-Forwarded-Port 443
}

(Static 443 is correct here: the proxy only serves HTTPS publicly; HTTP is redirected by Caddy before it reaches the app.)

Hit on tenant medocs (Next 16 + next-intl locale redirect on /). Currently worked around with a hand-edit of the rendered fragment on the host — which the next deploy-playbook run will overwrite, so an upstream template fix would be appreciated.

Happy to send a PR if useful.