Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_website/.env.example

@@ -1,3 +1,3 @@
-# Absolute websocket URL of the game server. Leave empty to use /api/ws on the
-# same host the website is served from (recommended behind the Caddy proxy).
+# Absolute websocket URL of the game server. Leave empty to connect to
+# ../api/ws relative to the page URL (recommended).
 VITE_WS_URL=

wizard_website/Dockerfile

@@ -6,8 +6,8 @@ COPY package.json package-lock.json ./
 RUN npm ci
 
 COPY . .
-# Optional absolute websocket URL of the game server, e.g. wss://api.example.com/api/ws.
-# By default the app connects to /api/ws on the host it was loaded from.
+# Optional absolute websocket URL of the game server, e.g. wss://game.example.com/wizard/api/ws.
+# By default the app connects to ../api/ws relative to the page URL.
 ARG VITE_WS_URL=
 ENV VITE_WS_URL=${VITE_WS_URL}
 RUN npm run build

wizard_website/README.md

@@ -6,13 +6,14 @@ React + TypeScript frontend (Vite). All component styles are CSS modules
 
 ```bash
 npm install
-npm run dev      # http://localhost:5173, proxies /api (incl. websocket) to localhost:8000
+npm run dev      # http://localhost:5173, proxies /api/* (incl. websocket) to localhost:8000 without the /api prefix
 npm run build
 npm run lint
 ```
 
-Set `WIZARD_SERVER_URL` to proxy to another server in development, or
-`VITE_WS_URL` at build time to connect to an absolute websocket URL.
+The app is built with relative asset paths and connects to `../api/ws` relative to its own URL
+(`/wizard/website/` → `/wizard/api/ws`). Set `WIZARD_SERVER_URL` to proxy to another server in
+development, or `VITE_WS_URL` at build time to use an absolute websocket URL instead.
 
 ## Structure
 

wizard_website/nginx.conf

@@ -6,19 +6,12 @@ server {
     # Hashed build assets can be cached forever.
     location /assets/ {
         add_header Cache-Control "public, max-age=31536000, immutable";
-        try_files $uri @strip_prefix;
+        try_files $uri =404;
     }
 
+    # Single page app: always serve index.html.
     location / {
         add_header Cache-Control "no-cache";
-        try_files $uri @strip_prefix;
-    }
-
-    # The reverse proxy may forward requests with their path prefix
-    # (e.g. /website/assets/app.js). Drop leading segments until a file
-    # matches; everything else is the single page app.
-    location @strip_prefix {
-        rewrite ^/[^/]+(/.+)$ $1 last;
-        rewrite ^ /index.html last;
+        try_files $uri /index.html;
     }
 }

wizard_website/src/api/useWizard.ts

@@ -29,8 +29,12 @@ const CLOSE_REPLACED = 4000
 function websocketUrl(): string {
   const configured = import.meta.env.VITE_WS_URL as string | undefined
   if (configured) return configured
-  const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'
-  return `${protocol}//${window.location.host}/api/ws`
+  // The API lives next to the website: /wizard/website/ -> /wizard/api/ws
+  // (and /api/ws in development).
+  const url = new URL('../api/ws', window.location.href)
+  url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:'
+  url.search = ''
+  return url.toString()
 }
 
 function readToken(): string | null {

wizard_website/vite.config.ts

@@ -7,11 +7,13 @@ export default defineConfig({
   // Relative asset URLs, so the app works under any path prefix (e.g. /website/).
   base: './',
   server: {
-    // Forward API requests (including the websocket) to a locally running game server.
+    // Forward API requests (including the websocket) to a locally running game
+    // server, stripping the prefix like the production reverse proxy does.
     proxy: {
       '/api': {
         target: process.env.WIZARD_SERVER_URL ?? 'http://localhost:8000',
         ws: true,
+        rewrite: (path) => path.replace(/^\/api/, ''),
       },
     },
   },