fix: nginx DNS resolver for Railway private networking

127.0.0.11 (Docker embedded DNS) is not available in Railway's container
environment. Instead, the correct nameserver is in /etc/resolv.conf at runtime.

Changes:
- web/start.sh: startup script that reads nameserver from /etc/resolv.conf
  and substitutes __DNS_RESOLVER__ placeholder in nginx.conf before starting
  nginx. Falls back to 8.8.8.8 if resolv.conf is empty (shouldn't happen).

- web/nginx.conf: replaces hard-coded '127.0.0.11' with '__DNS_RESOLVER__'
  placeholder that start.sh replaces at container startup.

- web/Dockerfile: copies start.sh and uses it as the container CMD instead
  of launching nginx directly.

This restores the /api/ and /auth/ proxy routes to api.railway.internal:3001
which allows the dashboard and Resend webhooks to work via openmail.win.

Co-authored-by: ShadowWalker2014 <ShadowWalker2014@users.noreply.github.com>

Author: cursoragent

web/Dockerfile

@@ -55,5 +55,8 @@ COPY --from=builder /app/docs/dist /usr/share/nginx/html/docs
 # and nginx's own $uri / $uri/ variables are preserved correctly.
 COPY web/nginx.conf /etc/nginx/conf.d/default.conf
 
+COPY web/start.sh /start.sh
+RUN chmod +x /start.sh
+
 EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["/start.sh"]

web/nginx.conf

@@ -4,9 +4,9 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    # Use Docker's internal DNS resolver so nginx re-resolves Railway
-    # private hostnames (api.railway.internal) instead of caching them.
-    resolver 127.0.0.11 valid=30s ipv6=off;
+    # DNS resolver is injected at startup from /etc/resolv.conf by start.sh.
+    # Placeholder is replaced with the container's actual nameserver IP.
+    resolver __DNS_RESOLVER__ valid=30s ipv6=off;
 
     # Security headers
     add_header X-Frame-Options "SAMEORIGIN" always;

web/start.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Resolve the container's actual DNS nameserver at startup and inject it
+# into nginx.conf so nginx can re-resolve Railway private hostnames
+# (api.railway.internal) without caching stale IPs across service restarts.
+#
+# Railway containers use a non-Docker DNS (not 127.0.0.11) — the correct
+# nameserver is in /etc/resolv.conf at runtime.
+
+NS=$(grep -m1 nameserver /etc/resolv.conf | awk '{print $2}')
+if [ -z "$NS" ]; then
+  echo "WARN: Could not read nameserver from /etc/resolv.conf, defaulting to 8.8.8.8"
+  NS="8.8.8.8"
+fi
+
+echo "INFO: Using DNS resolver: $NS"
+sed -i "s|__DNS_RESOLVER__|$NS|g" /etc/nginx/conf.d/default.conf
+
+exec nginx -g "daemon off;"