Add private Docker UI relay for Nginx Proxy Manager

cmd/ui-proxy/main.go

@@ -0,0 +1,46 @@
+// ui-proxy exposes the read-only loopback viewer to the private Docker gateway.
+package main
+
+import (
+	"flag"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+)
+
+func handler(target *url.URL) http.Handler {
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	original := proxy.Director
+	proxy.Director = func(r *http.Request) {
+		original(r)
+		r.Host = target.Host
+		// The viewer is read-only behind NPM; do not forward the public browser origin
+		// into the loopback-only origin guard. Mutating methods are rejected below.
+		r.Header.Del("Origin")
+	}
+	proxy.FlushInterval = -1 // stream SSE immediately
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			w.Header().Set("Allow", "GET, HEAD")
+			http.Error(w, "read-only viewer", http.StatusMethodNotAllowed)
+			return
+		}
+		proxy.ServeHTTP(w, r)
+	})
+}
+
+func main() {
+	address := flag.String("listen", "172.20.0.1:18082", "Private Docker gateway listener")
+	flag.Parse()
+	host, _, err := net.SplitHostPort(*address)
+	ip := net.ParseIP(host)
+	if err != nil || ip == nil || !ip.IsPrivate() {
+		log.Fatal("listen must use an explicit private IP and port")
+	}
+	target, _ := url.Parse("http://127.0.0.1:18080")
+	server := &http.Server{Addr: *address, Handler: handler(target), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 8 << 10}
+	log.Fatal(server.ListenAndServe())
+}