From 0d39beef70695a96aef45728ec2c61d642948a3b Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Wed, 18 Feb 2026 15:58:27 +0100
Subject: [PATCH] feat(infra): configure next.js image proxy to hide backend
 url

- Implemented /_img/ rewrite in next.config.mjs to proxy requests to IMGPROXY_URL
- Updated lib/imgproxy.ts to use local /_img path instead of public endpoint
- Replaced NEXT_PUBLIC_IMGPROXY_URL (build-time) with IMGPROXY_URL (runtime) env var
- Updated docker-compose.yml to strip build args and inject runtime IMGPROXY_URL
- Cleaned up Dockerfile and audit scripts
---
 docker-compose.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 5ca3cd90..d0ddf46e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,6 +15,8 @@ services:
           - klz.localhost
     env_file:
       - ${ENV_FILE:-.env}
+    environment:
+      IMGPROXY_URL: ${IMGPROXY_URL:-http://klz-imgproxy:8080}
     labels:
       - "traefik.enable=true"
       # HTTP ⇒ HTTPS redirect
@@ -115,10 +117,7 @@ services:
       DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-120in09oenaoinsd9iaidon}
       WEBSOCKETS_ENABLED: 'true'
       PUBLIC_URL: ${DIRECTUS_URL:-https://cms.klz-cables.com}
-      WEBSOCKETS_ENABLED: 'true'
-      PUBLIC_URL: ${DIRECTUS_URL:-https://cms.klz-cables.com}
       HOST: '0.0.0.0'
-      IMGPROXY_URL: ${IMGPROXY_URL:-http://klz-imgproxy:8080}
     networks:
       - default
       - infra