The address chargers are given is now an address that answers

The API Server tells a charger to dial the host it was itself asked on.
The panel asks through the Web App, so the address handed out is the Web
App's — which proxied /api/ and nothing else, and answered the WebSocket
handshake at /ocpp/ with index.html. A charger pointed at the endpoint the
screen showed could never connect to it, and the screen went on saying
"Not connected" without a hint as to why.

Both front doors now carry /ocpp/ through to the API Server: the BFF via
the same reverse proxy, which relays the 101 by hijacking, and the
all-in-one image's nginx via a location of its own, with timeouts long
enough for a session that is idle between heartbeats.

The proxied hop also has to say how the client arrived, since the API
Server reads X-Forwarded-Proto to decide a charger reached it over TLS.
That header is set from this server's own connection and overwrites
whatever came in: believing a client on that point would let a plaintext
charger claim wss and walk past OCPP_REQUIRE_TLS. TRUST_FORWARDED_PROTO
opts into the inbound value for the one deployment where it is true — TLS
ending at a proxy in front of the stack.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker/.env.example

@@ -34,6 +34,15 @@ AUTH_USERS_COLLECTION=users
 # public wss:// base, or set OCPP_REQUIRE_TLS=false on a trusted network.
 OCPP_REQUIRE_TLS=true
 OCPP_PUBLIC_URL=
+# The charger can dial either door: the API Server port directly, or the Web
+# App port, whose BFF now proxies /ocpp/ through to it. The endpoint the panel
+# shows is the API Server port only when OCPP_PUBLIC_URL says so — left blank it
+# is whichever host the panel itself was reached on, which is the Web App.
+# TRUST_FORWARDED_PROTO lets the BFF pass an inbound X-Forwarded-Proto to the
+# API Server: needed when TLS ends at a proxy in front of the stack and
+# OCPP_REQUIRE_TLS stays on, and unsafe otherwise, since the header is then
+# whatever the client said it was.
+TRUST_FORWARDED_PROTO=false
 
 # --- Host port mappings (optional; defaults shown) --------------------------
 PB_PORT=8070