Root causes of the 502 Bad Gateway on all orchestrator proxy endpoints:
1. Orchestrator bound to 127.0.0.1 by default — add HOST=0.0.0.0 to all
compose files so the orchestrator is reachable from other containers.
2. Web service missing ORCHESTRATOR_URL in docker-compose.yml and
docker-compose.coolify.yml — server-side proxy was falling through to
NEXT_PUBLIC_API_URL (the public API URL) which has no /agents or /health
endpoints. Add ORCHESTRATOR_URL=http://orchestrator:3001 so the web
container routes to the orchestrator service over the internal network.
3. Orchestrator missing ORCHESTRATOR_API_KEY in docker-compose.yml and
docker-compose.swarm.portainer.yml — the OrchestratorApiKeyGuard would
reject all requests with 401 (or 502 when unreachable first).
4. Web service missing mosaic-internal network in docker-compose.yml —
orchestrator was only on mosaic-internal while web was only on
mosaic-public, making them unreachable by name.
Closes SS-ORCH-001 (issue #534)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
