Merge admin panel into the port-80 webtools site under /admin/

webtools' nginx now reverse-proxies /admin/ to the webadmin container
(docker/conf/webtools-nginx.conf), which no longer publishes its own
port -- everything is reachable through port 80 alongside the GM
toolbox. Added a link to it in webtools/index.html's sidebar.

Flask needs to know it's mounted under /admin/ to generate correct
url_for()/redirect() targets, so app.py now wraps the app in
werkzeug's ProxyFix (x_prefix/x_proto/x_for/x_host) reading the
X-Forwarded-Prefix header nginx sets; verified redirects, form
actions, and links all come back /admin/-prefixed end to end through
port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -88,6 +88,9 @@ services:
       - "80:80"
     volumes:
       - "./webtools:/usr/share/nginx/html:ro"
+      - "./docker/conf/webtools-nginx.conf:/etc/nginx/conf.d/default.conf:ro"
+    depends_on:
+      - webadmin
 
   webadmin:
     build:
@@ -101,8 +104,8 @@ services:
       DB_NAME: ${DB_NAME:-ktrose}
       ADMIN_SECRET_KEY: ${ADMIN_SECRET_KEY:-change-me-too}
       ADMIN_MIN_ACCESSLEVEL: ${ADMIN_MIN_ACCESSLEVEL:-900}
-    ports:
-      - "8081:8080"
+    expose:
+      - "8080"
     depends_on:
       db:
         condition: service_healthy

docker/conf/webtools-nginx.conf

@@ -0,0 +1,19 @@
+server {
+    listen 80;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location /admin/ {
+        proxy_pass http://webadmin:8080/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Prefix /admin;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

webadmin/app.py

@@ -5,9 +5,14 @@ import hashlib
 import pymysql
 import pymysql.cursors
 from flask import Flask, request, session, redirect, url_for, render_template, flash
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 app = Flask(__name__)
 app.secret_key = os.environ.get("ADMIN_SECRET_KEY", "dev-only-change-me")
+# Sits behind the webtools nginx container at /admin/ (see webtools/nginx.conf);
+# this reads X-Forwarded-Prefix/-Proto/-For so url_for()/redirect() produce
+# correct /admin/-prefixed URLs instead of root-relative ones.
+app.wsgi_app = ProxyFix(app.wsgi_app, x_prefix=1, x_proto=1, x_for=1, x_host=1)
 
 
 def hash_password(plaintext):

webtools/index.html

@@ -56,13 +56,15 @@
   .brand .sub{font-size:0.7rem; letter-spacing:0.1em; text-transform:uppercase; color:var(--ink-faint); margin-top:2px;}
 
   .tabs{display:flex; flex-direction:column; gap:3px;}
-  .tab{
+  .tab, .tab-link{
     display:flex; align-items:center; gap:9px; padding:9px 11px; border-radius:8px;
     font-size:0.9rem; color:var(--ink-dim); cursor:pointer; border:1px solid transparent;
+    text-decoration:none;
   }
-  .tab:hover{background:var(--bg-card); color:var(--ink);}
+  .tab:hover, .tab-link:hover{background:var(--bg-card); color:var(--ink);}
   .tab.active{background:var(--bg-card); border-color:var(--line); color:var(--ink); font-weight:600;}
-  .tab .ico{font-size:1rem; width:1.2em; text-align:center;}
+  .tab .ico, .tab-link .ico{font-size:1rem; width:1.2em; text-align:center;}
+  .tab-link{border-top:1px solid var(--line); margin-top:6px; padding-top:12px;}
 
   .side-panel{display:none; flex-direction:column; gap:10px;}
   .side-panel.active{display:flex;}
@@ -173,6 +175,7 @@
       <div class="tab active" data-view="commands"><span class="ico">⌘</span> GM Commands</div>
       <div class="tab" data-view="items"><span class="ico">◆</span> Item Configurator</div>
       <div class="tab" data-view="maps"><span class="ico">⌗</span> Maps</div>
+      <a class="tab-link" href="/admin/"><span class="ico">⚙</span> Admin Panel</a>
     </nav>
 
     <div class="side-panel active" id="panel-commands">