The address chargers are given is now an address that answers

The API Server tells a charger to dial the host it was itself asked on.
The panel asks through the Web App, so the address handed out is the Web
App's — which proxied /api/ and nothing else, and answered the WebSocket
handshake at /ocpp/ with index.html. A charger pointed at the endpoint the
screen showed could never connect to it, and the screen went on saying
"Not connected" without a hint as to why.

Both front doors now carry /ocpp/ through to the API Server: the BFF via
the same reverse proxy, which relays the 101 by hijacking, and the
all-in-one image's nginx via a location of its own, with timeouts long
enough for a session that is idle between heartbeats.

The proxied hop also has to say how the client arrived, since the API
Server reads X-Forwarded-Proto to decide a charger reached it over TLS.
That header is set from this server's own connection and overwrites
whatever came in: believing a client on that point would let a plaintext
charger claim wss and walk past OCPP_REQUIRE_TLS. TRUST_FORWARDED_PROTO
opts into the inbound value for the one deployment where it is true — TLS
ending at a proxy in front of the stack.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker-AIO/Dockerfile

@@ -94,7 +94,7 @@ map $http_upgrade $connection_upgrade {
 }
 NGINXMAP
 
-# nginx: serve the SPA and proxy /api/ to the API Server on localhost.
+# nginx: serve the SPA and proxy /api/ + /ocpp/ to the API Server on localhost.
 RUN cat > /etc/nginx/http.d/default.conf <<'NGINX'
 server {
     listen 80;
@@ -126,6 +126,24 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # The chargers' door, not the browser's. The API Server tells a charger to
+    # dial the host it was itself asked on — this one — so without this location
+    # the SPA fallback would answer the WebSocket handshake with index.html.
+    location /ocpp/ {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # A charging session is idle between heartbeats; the default 60s would
+        # close it under the charger.
+        proxy_read_timeout 1h;
+        proxy_send_timeout 1h;
+    }
+
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";