patches on sxsw ai working api key working container hardened plus many more

neode-ui/src/stores/appLauncher.ts

@@ -11,12 +11,12 @@ import { rpcClient } from '@/api/rpc-client'
  */
 const IFRAME_BLOCKED_HOSTS: string[] = []
 
-/** External sites proxied through nginx on dedicated ports (strips X-Frame-Options).
- *  Each site gets its own port so SPAs work at root — no subpath rewriting needed. */
-const EXTERNAL_PROXY_PORT: Record<string, number> = {
-  'botfights.net': 8901,
-  '484.kitchen': 8902,
-  'present.l484.com': 8903,
+/** External sites proxied through nginx path-based locations (strips X-Frame-Options).
+ *  Uses /ext/{key}/ paths on the main nginx port so it works over Tailscale too. */
+const EXTERNAL_PROXY_PATH: Record<string, string> = {
+  'botfights.net': '/ext/botfights/',
+  '484.kitchen': '/ext/484-kitchen/',
+  'present.l484.com': '/ext/arch-presentation/',
 }
 
 function mustOpenInNewTab(url: string): boolean {
@@ -84,10 +84,10 @@ function toEmbeddableUrl(url: string): string {
     const u = new URL(url)
     const origin = window.location.origin
 
-    // External sites proxied through nginx on dedicated ports
-    const extPort = EXTERNAL_PROXY_PORT[u.hostname]
-    if (extPort) {
-      return `${window.location.protocol}//${window.location.hostname}:${extPort}/`
+    // External sites proxied through nginx path-based locations
+    const extPath = EXTERNAL_PROXY_PATH[u.hostname]
+    if (extPath) {
+      return `${origin}${extPath}`
     }
 
     const proxyPath = PORT_TO_PROXY[u.port]