Merge commit '61adc80615' into dev

surfsense_web/app/(home)/free/layout.tsx

@@ -0,0 +1,18 @@
+import type { ReactNode } from "react";
+import { AdSenseScript } from "@/components/ads/adsense-script";
+
+/**
+ * Wraps the /free hub and all /free/[model_slug] subpages. Mounting
+ * <AdSenseScript /> here loads adsbygoogle.js across the entire /free route
+ * tree, which is what powers both the manual <AdUnit /> slots and AdSense
+ * Auto ads. Because the script lives here (not in the root layout), Auto ads
+ * is naturally scoped to /free and its subpages only.
+ */
+export default function FreeSectionLayout({ children }: { children: ReactNode }) {
+	return (
+		<>
+			<AdSenseScript />
+			{children}
+		</>
+	);
+}

surfsense_web/app/(home)/free/page.tsx

@@ -3,7 +3,6 @@ import type { Metadata } from "next";
 import Link from "next/link";
 import { AdUnit } from "@/components/ads/ad-unit";
 import { ADSENSE_SLOTS } from "@/components/ads/adsense-config";
-import { AdSenseScript } from "@/components/ads/adsense-script";
 import { BreadcrumbNav } from "@/components/seo/breadcrumb-nav";
 import { FAQJsonLd, JsonLd } from "@/components/seo/json-ld";
 import { Badge } from "@/components/ui/badge";
@@ -160,7 +159,6 @@ export default async function FreeHubPage() {
 
 	return (
 		<div className="min-h-screen pt-20">
-			<AdSenseScript />
 			<JsonLd
 				data={{
 					"@context": "https://schema.org",

surfsense_web/app/api/zero/query/route.ts

@@ -5,12 +5,16 @@ import type { Context } from "@/types/zero";
 import { queries } from "@/zero/queries";
 import { schema } from "@/zero/schema";
 
-function getBackendBaseUrl() {
-	const base = process.env.FASTAPI_BACKEND_INTERNAL_URL || "http://localhost:8000";
-	return base.endsWith("/") ? base.slice(0, -1) : base;
-}
-
-const backendURL = getBackendBaseUrl();
+// This route is invoked server-to-server by zero-cache (via ZERO_QUERY_URL),
+// so it must reach the backend over the internal Docker network
+// (e.g. http://backend:8000). The browser-facing NEXT_PUBLIC_FASTAPI_BACKEND_URL
+// (e.g. http://localhost:8929) does NOT resolve from inside the frontend
+// container and would make every authenticated Zero query fail with a 503.
+const backendURL = (
+	process.env.FASTAPI_BACKEND_INTERNAL_URL ||
+	BACKEND_URL ||
+	"http://localhost:8000"
+).replace(/\/$/, "");
 
 async function authenticateRequest(
 	request: Request