nginx: re-resolve service addresses so it survives docker compose restart

[ArtyomSavchenko]

After docker compose restart nginx could return 502 (or proxy to the wrong service): it resolved service names once at startup, and restarted containers can come back with different IPs. Seen in CI: nginx sent /_accounts to 172.18.0.15, which by then was fulltext; account was at 172.18.0.3.

Fix (.huly.nginx)

• resolver 127.0.0.11 valid=10s ipv6=off; — Docker's DNS on huly_net
• upstreams go through a variable (set $upstream http://account:3000; proxy_pass $upstream;), which makes nginx resolve them per request (cached 10s)
• set is placed before rewrite ... break (break skips later rewrite-module directives, including set)
• prefixes are stripped with rewrite ^/_x/?(.*)$ /$1 break; so /_accounts still maps to / as with the old proxy_pass http://account:3000/;
• commented-out optional services (print, aibot, love, pulse, telegram, github, export) follow the same pattern, so uncommenting them keeps working

Checked

• Old and new config side by side (local nginx, stub services): identical upstream and path for /, /files?…, /_accounts, /_accounts/api/…?token=…, /_collaborator/…, /_transactor/<token>, /eyJ…, /_rekoni/…, /_stats/…?a=b&c=d, GET and POST
• Changing a service's DNS answer: new config follows the new IP within 10s, old config keeps the startup one
• CI: new step Services recreated behind a running nginx recreates account and transactor (new IPs) and re-runs smoke.sh --verify. With the old config the restart step failed again on this PR (ede6e6b); with the fix two runs in a row are green.

🤖 Generated with Claude Code

https://claude.ai/code/session_012bF628vAWVF7d1gqS2bQwG

---

Generated by Claude Code