feat: add API_URL_SSR to override api url during ssr

Author: lindesvard

apps/public/content/docs/self-hosting/environment-variables.mdx

@@ -129,6 +129,29 @@ Public API URL exposed to the browser. Used by the dashboard frontend and API se
 API_URL=https://analytics.example.com/api
 ```
 
+### API_URL_SSR
+
+**Type**: `string`  
+**Required**: No  
+**Default**: Same as `API_URL`
+
+Internal API URL used **only** for the dashboard's server-side rendering (SSR) requests. Set this when the dashboard server can't resolve or reach the public `API_URL` and needs an internal address instead — for example a Docker Compose service name or a Kubernetes cluster-internal address.
+
+The browser always keeps using the public `API_URL`; only requests made from the dashboard server during SSR use `API_URL_SSR`. If unset, SSR falls back to `API_URL`.
+
+**Example**:
+```bash
+# Docker Compose: reach the API service directly over the internal network
+API_URL_SSR=http://api:3000
+
+# Kubernetes: cluster-internal service DNS
+API_URL_SSR=http://openpanel-api.default.svc.cluster.local:3000
+```
+
+<Callout>
+This only affects the dashboard's server-side requests. It does not change the API service itself, CORS, or any browser-facing URLs — those still use `API_URL`.
+</Callout>
+
 ### DASHBOARD_URL
 
 **Type**: `string`  

apps/start/src/integrations/tanstack-query/root-provider.tsx

@@ -21,15 +21,35 @@ function shouldRetryQuery(failureCount: number, error: unknown) {
 }
 
 function handleUnauthorized(error: unknown) {
-  if (typeof window === 'undefined') return;
-  if (!(error instanceof TRPCClientError)) return;
-  if (error.data?.httpStatus !== 401) return;
-  if (window.location.pathname.startsWith('/login')) return;
+  if (typeof window === 'undefined') {
+    return;
+  }
+  if (!(error instanceof TRPCClientError)) {
+    return;
+  }
+  if (error.data?.httpStatus !== 401) {
+    return;
+  }
+  if (window.location.pathname.startsWith('/login')) {
+    return;
+  }
   // Hard navigation tears down in-flight refetches and WS subscriptions so
   // the stale tab stops hammering the API after the session is gone.
   window.location.assign('/login');
 }
 
+// Resolve the tRPC base URL per environment. During SSR the server can reach
+// the API over an internal address (e.g. a Docker/K8s service name) that the
+// browser can't resolve, so `API_URL_SSR` overrides the public `apiUrl`
+// server-side only. The client always uses the public `apiUrl` it was given.
+const getSsrApiUrlOverride = createIsomorphicFn()
+  .server(() => {
+    console.log('ENVS', process.env);
+    console.log('API_URL_SSR', process.env.API_URL_SSR);
+    return process.env.API_URL_SSR || undefined;
+  })
+  .client(() => undefined);
+
 export const getIsomorphicHeaders = createIsomorphicFn()
   .server(() => {
     const headers = getRequestHeaders();
@@ -50,11 +70,13 @@ export const getIsomorphicHeaders = createIsomorphicFn()
 
 // Create a function that returns a tRPC client with optional cookies
 export function createTRPCClientWithHeaders(apiUrl: string) {
+  const baseUrl = getSsrApiUrlOverride() || apiUrl;
+  console.log('baseUrl', baseUrl);
   return createTRPCClient<AppRouter>({
     links: [
       httpLink({
         transformer: superjson,
-        url: `${apiUrl}/trpc`,
+        url: `${baseUrl}/trpc`,
         headers: () => getIsomorphicHeaders(),
         fetch: async (url, options) => {
           try {