Fix noVNC WebSocket routing

docker-compose.yml

@@ -15,11 +15,14 @@ services:
     # path on every restart.
     volumes:
       - reddit_bot_data:/app/data
-    # Ports are NOT published to the host. Dokploy/Traefik routes traffic
-    # to the container's internal ports via configured domains.
+    # The dashboard goes through Traefik. noVNC must bypass the upstream
+    # proxy because it strips WebSocket Upgrade requests needed by websockify.
+    # Restrict host port 16080 with the host firewall; VNC_PASSWORD still
+    # authenticates the VNC session.
+    ports:
+      - "16080:6080"
     expose:
       - "3000"   # Web dashboard
-      - "6080"   # noVNC for human login
     environment:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       # Required whenever the web dashboard is enabled; never commit its value.
@@ -30,8 +33,9 @@ services:
       - BROWSER_HEADLESS=false
       # Required to lock down the VNC endpoint.
       - VNC_PASSWORD=${VNC_PASSWORD}
-      # Public Traefik route used by the dashboard's recovery button.
-      - NOVNC_PUBLIC_URL=https://red-vnc.apps.jbrunton.co.uk
+      # Direct noVNC URL, e.g. http://<dokploy-host>:16080. It must not go
+      # through the WebSocket-stripping reverse proxy.
+      - NOVNC_PUBLIC_URL=${NOVNC_PUBLIC_URL}
 
 volumes:
   reddit_bot_data: