From d6f980574631628e295ebdc58d779e5aedf03e80 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Mon, 20 Jul 2026 04:08:32 +0200
Subject: [PATCH] fix(web-app-openproject): route swarm ingress straight to the
 web service

In Swarm the front proxy targeted the Apache proxy service (:80), which
was unreachable on the overlay, so OpenResty returned connection refused
and the probe got 'No server is currently available'. Puma web was
healthy on :8080 the whole time. Set proxy_internal_port to the web
service internal port (8080) in Swarm so sys-stk-full proxies straight
to Puma over overlay DNS, bypassing the Apache hop; Compose keeps the
published-port Apache path (empty proxy_internal_port). Document the
compose-vs-swarm routing split in the role README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 roles/web-app-openproject/README.md         | 20 ++++++++++++++++++++
 roles/web-app-openproject/tasks/01_core.yml |  9 +++++++++
 2 files changed, 29 insertions(+)

diff --git a/roles/web-app-openproject/README.md b/roles/web-app-openproject/README.md
index 0d8163a983..80ab20eaed 100644
--- a/roles/web-app-openproject/README.md
+++ b/roles/web-app-openproject/README.md
@@ -67,6 +67,26 @@ flowchart LR
 
 Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments). Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
 
+## Schema
+
+OpenProject uses the published Apache proxy in Compose and reaches the Puma web service directly through overlay DNS in Swarm.
+
+```mermaid
+flowchart LR
+    ingress["OpenResty"]
+    subgraph compose [Compose]
+        compose_host["127.0.0.1:8023"]
+        compose_proxy["proxy:80 (Apache)"]
+        compose_web["web:8080 (Puma)"]
+        compose_host --> compose_proxy --> compose_web
+    end
+    subgraph swarm [Swarm]
+        swarm_web["openproject_web:8080 (Puma)"]
+    end
+    ingress -->|"published port"| compose_host
+    ingress -->|"overlay DNS"| swarm_web
+```
+
 ## Purpose
 
 The purpose of this role is to reduce the complexity of setting up OpenProject with modern production-ready defaults. By combining Docker Compose and Ansible automation, it enables a hands-off setup for both small teams and larger internal infrastructures.
diff --git a/roles/web-app-openproject/tasks/01_core.yml b/roles/web-app-openproject/tasks/01_core.yml
index ab23868ac3..431481e073 100644
--- a/roles/web-app-openproject/tasks/01_core.yml
+++ b/roles/web-app-openproject/tasks/01_core.yml
@@ -6,6 +6,15 @@
     name: sys-stk-full
   vars:
     webserver_client_max_body_size: "30m"
+    proxy_internal_port: >-
+      {{
+        lookup(
+          'config',
+          application_id,
+          'services.' ~ OPENPROJECT_WEB_SERVICE ~ '.ports.internal.http'
+        )
+        if DEPLOYMENT_MODE == 'swarm' else ''
+      }}
     compose_repository_url: "{{ OPENPROJECT_REPOSITORY }}"
     compose_repository_ref: "{{ OPENPROJECT_REF }}"
     compose_repository_pull: true