F5/hard refresh on deep routes fails when behind a reverse proxy (redirects to proxy error page)

[AlexRNL]

I have used AI to help me write a better (hopefully) issue, as i'm not a web programmer and not that familiar with routing in JS/web application.

Environment:

• Tracktor version:  1.4.1 
• Deployment: Docker ghcr.io/javedh-dev/tracktor:1.4.1
• Reverse proxy: Synology DSM built-in nginx reverse proxy
• NODE_ENV=production ,  HOSTNAME=0.0.0.0

Description:

When accessing Tracktor behind a reverse proxy (e.g. https://tracktor.example.com), navigating within the app works correctly. However, doing a hard refresh (F5) or directly opening a deep route (e.g. https://tracktor.example.com/dashboard/overview) results in an error page from the reverse proxy instead of loading the app.

Steps to reproduce:

1. Deploy Tracktor behind a reverse proxy (source: https://tracktor.example.com:443 → destination: http://localhost:12345
2. Open https://tracktor.example.com → app loads correctly ✅
3. Navigate to https://tracktor.example.com/dashboard/overview via the app UI → works ✅
4. Press F5 / hard refresh on https://tracktor.example.com/dashboard/overview → reverse proxy error page ❌

Expected behavior:

Hard refresh on any deep route should return the app shell (index.html), allowing the client-side router to handle the route.

Observed behavior:

The server returns a non-200 response for the deep route (likely 404 or redirect), which the reverse proxy interprets as an error and displays its own error page.

Workaround:
Accessing Tracktor directly without the reverse proxy (e.g. http://nas-hostname:12345/dashboard/overview) works correctly with F5.

This suggests the issue is either:

• The server not returning index.html as a fallback for unknown routes in production mode (standard SPA requirement)
• Or a redirect loop introduced when the reverse proxy is in the chain

Additional context:

• CORS_ORIGINS is set to include the reverse proxy domain
• BASE_PATH is not set (serving from root /)
• The issue does not occur when bypassing the reverse proxy