Document portal env and log SNI failures

Restore VITE_API_URL to :8080 in .env.example with notes
for local Vite (:5174 + proxy target). Log compliance
portal lookup errors in the SNI middleware with context.

Signed-off-by: Émile Ré <emile@probo.com>

apps/compliance-portal/.env.example

@@ -1,5 +1,9 @@
-# Browser hits the Vite origin; /graphql is proxied (see vite.config.ts).
+# GraphQL API origin. Default matches other apps (probod on :8080). For local
-VITE_API_URL=http://localhost:5174
+# Vite development, set this to http://localhost:5174 so the browser hits the
+# Vite origin and /graphql is proxied (see vite.config.ts).
+VITE_API_URL=http://localhost:8080
 
-# Compliance-portal HTTPS origin (<slug> is the compliance portal slug).
+# Vite /graphql proxy target (compliance-portal HTTPS origin; <slug> is the
-COMPLIANCE_PORTAL_PROXY_TARGET=https://<slug>.probopage.localhost
+# portal slug). Required for local Vite development — uncomment and set the
+# slug when running the app locally (see vite.config.ts).
+# COMPLIANCE_PORTAL_PROXY_TARGET=https://<slug>.probopage.localhost

pkg/server/api/complianceportal/sni_middleware.go

@@ -30,6 +30,7 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
@@ -51,6 +52,13 @@ func NewSNIMiddleware(visitorSvc *visitor.Service) func(next http.Handler) http.
 					return
 				}
 
+				httpserver.LoggerFromContext(ctx).ErrorCtx(
+					ctx,
+					"cannot get compliance portal by domain name",
+					log.Error(err),
+					log.String("server_name", r.TLS.ServerName),
+				)
+
 				httpserver.RenderJSON(
 					w,
 					http.StatusInternalServerError,
@@ -70,6 +78,13 @@ func NewSNIMiddleware(visitorSvc *visitor.Service) func(next http.Handler) http.
 			if !strings.HasPrefix(r.URL.Path, "/.well-known/") {
 				canonicalHost, err := visitorSvc.GetPortalEffectiveCanonicalHost(ctx, compliancePage.ID)
 				if err != nil {
+					httpserver.LoggerFromContext(ctx).ErrorCtx(
+						ctx,
+						"cannot get compliance portal canonical host",
+						log.Error(err),
+						log.String("compliance_portal_id", compliancePage.ID.String()),
+					)
+
 					httpserver.RenderJSON(
 						w,
 						http.StatusInternalServerError,