feat: replace nginx supervisor proxy with modern supervisor-ui

- Replaced nginx:alpine proxy with dev.pivoine.art/valknar/supervisor-ui:latest
- Modern Next.js UI with real-time SSE updates, batch operations, and charts
- Changed service port from 80 (nginx) to 3000 (Next.js)
- Removed supervisor-nginx.conf (no longer needed)
- Kept same URL (supervisor.ai.pivoine.art) and Authelia SSO protection
- Added health check for /api/health endpoint
- Service connects to RunPod Supervisor via Tailscale (SUPERVISOR_HOST/PORT)

ai/compose.yaml

@@ -235,20 +235,26 @@ services:
       # Watchtower
       - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
-  # Supervisor - Process manager web UI (proxies to RunPod GPU)
-  supervisor:
-    image: nginx:alpine
-    container_name: ${AI_COMPOSE_PROJECT_NAME}_supervisor
+  # Supervisor UI - Modern web interface for RunPod process management
+  supervisor-ui:
+    image: dev.pivoine.art/valknar/supervisor-ui:latest
+    container_name: ${AI_COMPOSE_PROJECT_NAME}_supervisor_ui
     restart: unless-stopped
     environment:
       TZ: ${TIMEZONE:-Europe/Berlin}
-      SUPERVISOR_BACKEND_HOST: ${GPU_TAILSCALE_IP}
-      SUPERVISOR_BACKEND_PORT: ${SUPERVISOR_BACKEND_PORT:-9001}
-    volumes:
-      - ./supervisor-nginx.conf:/etc/nginx/nginx.conf.template:ro
-    command: /bin/sh -c "envsubst '$${SUPERVISOR_BACKEND_HOST},$${SUPERVISOR_BACKEND_PORT}' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && exec nginx -g 'daemon off;'"
+      NODE_ENV: production
+      # Connect to RunPod Supervisor via Tailscale
+      SUPERVISOR_HOST: ${GPU_TAILSCALE_IP}
+      SUPERVISOR_PORT: ${SUPERVISOR_BACKEND_PORT:-9001}
+      # No auth needed - Supervisor has auth disabled (protected by Authelia)
     networks:
       - compose_network
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
     labels:
       - 'traefik.enable=${AI_SUPERVISOR_TRAEFIK_ENABLED:-true}'
       # HTTP to HTTPS redirect
@@ -262,8 +268,8 @@ services:
       - 'traefik.http.routers.${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure.entrypoints=web-secure'
       - 'traefik.http.middlewares.${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure-compress.compress=true'
       - 'traefik.http.routers.${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure.middlewares=${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure-compress,net-authelia,security-headers@file'
-      # Service
-      - 'traefik.http.services.${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure.loadbalancer.server.port=80'
+      # Service (port 3000 for Next.js app)
+      - 'traefik.http.services.${AI_COMPOSE_PROJECT_NAME}-supervisor-web-secure.loadbalancer.server.port=3000'
       - 'traefik.docker.network=${NETWORK_NAME}'
       # Watchtower
       - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'