fix idp on started

install.sh

@@ -10,7 +10,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="2.2.2"
+SCRIPT_VERSION="2.2.3"
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$ROOT_DIR"
 
@@ -1323,11 +1323,12 @@ EOF
 }
 
 build_nginx_idp_api_proxy_block() {
-  local api_upstream
+  local api_upstream ws_upstream
   api_upstream="$(nginx_upstream api)"
+  ws_upstream="$(nginx_upstream ws)"
   cat <<EOF
     location /idp-api/ws {
-        proxy_pass ${api_upstream}/ws;
+        proxy_pass ${ws_upstream}/ws;
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -1893,6 +1894,22 @@ action_configure_domains() {
   print_summary
 }
 
+apply_intranet_selfsigned_runtime() {
+  load_env
+  [[ "$(env_get SSL_TYPE none)" == "selfsigned" ]] || return 0
+  [[ -n "$(env_get DOMAIN_FRONTEND "")" ]] || return 0
+
+  derive_public_urls "selfsigned"
+  env_set PUBLIC_API_URL "${PUBLIC_API_URL}"
+  env_set PUBLIC_WS_URL "${PUBLIC_WS_URL}"
+  env_set INTERNAL_API_URL "http://api-gateway:3000"
+  env_set INTERNAL_WS_URL "http://media-ws:8085"
+
+  log "Пересборка frontend (same-origin /idp-api)..."
+  build_compose_stack_cmd
+  docker_cmd "${COMPOSE_STACK_CMD[@]}" up -d --build frontend
+}
+
 action_renew_ssl() {
   load_env
   local ssl_type
@@ -1908,7 +1925,8 @@ action_renew_ssl() {
     selfsigned)
       generate_all_self_signed_certs --force
       write_all_nginx_configs "selfsigned"
-      ok "Самоподписанные сертификаты пересозданы"
+      apply_intranet_selfsigned_runtime
+      ok "Самоподписанные сертификаты пересозданы, frontend обновлён"
       ;;
     none)
       fail "SSL отключён (SSL_TYPE=none). Выберите --ssl selfsigned или letsencrypt."
@@ -1939,14 +1957,7 @@ action_fix_host_proxy() {
   log "Шаг 4/4: конфиги системного Nginx..."
   refresh_host_nginx_configs
 
-  if [[ "$(env_get SSL_TYPE none)" == "selfsigned" && -n "$(env_get DOMAIN_FRONTEND "")" ]]; then
-    derive_public_urls "selfsigned"
-    env_set PUBLIC_API_URL "${PUBLIC_API_URL}"
-    env_set PUBLIC_WS_URL "${PUBLIC_WS_URL}"
-    log "Шаг 5/5: пересборка frontend (same-origin API для HTTPS)..."
-    build_compose_stack_cmd
-    docker_cmd "${COMPOSE_STACK_CMD[@]}" up -d --build frontend
-  fi
+  apply_intranet_selfsigned_runtime
 
   ok "Прокси исправлен — проверьте: curl -I http://127.0.0.1:3002"
   show_status