From dcb7c74531d385810b1676fe228dd28bc27af665 Mon Sep 17 00:00:00 2001
From: Viktor Barzin <vbarzin@gmail.com>
Date: Tue, 2 Jun 2026 23:21:25 +0000
Subject: [PATCH] =?UTF-8?q?url/shlink:=20fix=20admin=20UI=20=E2=80=94=20pi?=
 =?UTF-8?q?n=20shlink-web-client=204.7.1=20+=20port=208080?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shlink-web admin SPA (shlink.viktorbarzin.me) showed "Something went
wrong while loading short URLs". Root cause: the web client was untagged
(:latest) and Keel's 2026-05-26 match-tag rewrite downgraded it to the
ancient 0.1.1 (2019 image), which speaks the removed /rest/v1/authenticate
API (404) and serves nginx on port 80. Backend (shlink:5.0.2) was healthy.

Pin shlink-web-client to 4.7.1 (current stable; :latest/:stable resolve to
it) and align container port + both probes + service target_port to 8080
(the port the 4.x nginx listens on). A clean semver anchor can no longer be
Keel-downgraded to 0.1.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 stacks/url/main.tf | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/stacks/url/main.tf b/stacks/url/main.tf
index 9ff36052..4544a0a1 100644
--- a/stacks/url/main.tf
+++ b/stacks/url/main.tf
@@ -372,7 +372,7 @@ resource "kubernetes_deployment" "shlink-web" {
       }
       spec {
         container {
-          image = "shlinkio/shlink-web-client"
+          image = "shlinkio/shlink-web-client:4.7.1"
           name  = "shlink-web"
           volume_mount {
             mount_path = "/usr/share/nginx/html/servers.json"
@@ -388,16 +388,19 @@ resource "kubernetes_deployment" "shlink-web" {
               memory = "64Mi"
             }
           }
-          # shlinkio/shlink-web-client >=0.1.0 listens on port 80 (nginx default);
-          # prior :latest builds listened on 8080. Keep both probes + service
-          # target_port aligned with the image.
+          # shlinkio/shlink-web-client 4.x serves via non-root nginx on port 8080.
+          # The ancient 0.1.1 image served on 80; Keel's 2026-05-26 match-tag
+          # rewrite had pinned the untagged (:latest) image down to 0.1.1, which
+          # forced this whole block to 80 and broke the admin UI (the 0.1.1 client
+          # also speaks the removed /rest/v1/authenticate API). Pinned to 4.7.1 —
+          # keep container port + probes + service target_port at 8080.
           port {
-            container_port = 80
+            container_port = 8080
           }
           liveness_probe {
             http_get {
               path = "/"
-              port = 80
+              port = 8080
             }
             initial_delay_seconds = 15
             period_seconds        = 30
@@ -407,7 +410,7 @@ resource "kubernetes_deployment" "shlink-web" {
           readiness_probe {
             http_get {
               path = "/"
-              port = 80
+              port = 8080
             }
             initial_delay_seconds = 5
             period_seconds        = 30
@@ -455,7 +458,7 @@ resource "kubernetes_service" "shlink-web" {
     port {
       name        = "http"
       port        = 80
-      target_port = 80
+      target_port = 8080
     }
   }
 }