Add CORS proxy for MiniStack browser access from hosted app

[dmux]

Summary

Fixes browser CORS errors when accessing localhost:4566 from the hosted app (app.openarchflow.cloud). When a user connects the OpenArchFlow frontend to MiniStack running on their local machine, the browser enforces CORS policy and blocks direct access to http://localhost:4566 without proper response headers.

MiniStack doesn't provide global CORS configuration, so this change adds:

• nginx-based reverse-proxy (docker/ministack-cors-proxy/) that adds Access-Control-Allow-Origin and handles OPTIONS preflight requests required by AWS SigV4 signatures
• Docker Compose orchestration (docker-compose.ministack.yml) to start MiniStack + proxy sidecar on port 4567
• Comprehensive documentation explaining when to use the proxy (hosted app) vs direct access (local app)
• UI hints in MiniStackConfigDialog pointing users to setup instructions when they hit CORS errors
• Updated comments in code and CHANGELOG reflecting actual CORS behavior

Technical Details

The proxy:

• Streams large payloads (S3 uploads, Lambda .zip files) without buffering
• Preserves Host headers for AWS SigV4 signature verification
• Handles CORS preflight requests by reflecting Access-Control-Request-Headers instead of hard-coding header allowlists
• Uses Docker DNS resolver to allow runtime re-resolution of ministack service name

Test Plan

# Start the stack
docker compose -f docker-compose.ministack.yml up -d --build

# Verify CORS headers are added
curl -i -H "Origin: https://app.openarchflow.cloud" http://localhost:4567/_ministack/health
# Should return: Access-Control-Allow-Origin: *

# Verify OPTIONS preflight
curl -i -X OPTIONS \
  -H "Origin: https://app.openarchflow.cloud" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: authorization,x-amz-date,x-amz-content-sha256" \
  http://localhost:4567/
# Should return 204 with reflected Allow-Headers

# Verify direct access to :4566 (for non-browser tools) still works
curl -i http://localhost:4566/_ministack/health

# End-to-end: Open https://app.openarchflow.cloud, configure endpoint to http://localhost:4567, test connection

Breaking Changes

None. This is fully backward compatible:

• Local OpenArchFlow deployments continue to use localhost:4566 directly
• Hosted app users opt-in to the proxy via documentation
• DEFAULT_MINISTACK_CONFIG.endpoint remains http://localhost:4566 (no silent changes to saved configs)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openarchflow-app	Ready	Preview, Comment	Jul 24, 2026 10:37pm