fix: route internal access checks over local HTTP

proxy.ts

@@ -109,6 +109,31 @@ function isLoopbackIp(ip: string | null) {
   );
 }
 
+function getInternalAccessUrl(request: NextRequest, pathname: string) {
+  const configuredBaseUrl = process.env.ACCESS_LOG_INTERNAL_URL?.trim();
+  if (configuredBaseUrl) {
+    try {
+      return new URL(pathname, configuredBaseUrl);
+    } catch {
+      // Fall through to the self-hosted runtime address.
+    }
+  }
+
+  const port = process.env.PORT?.trim();
+  if (port && /^\d{1,5}$/.test(port)) {
+    return new URL(pathname, `http://127.0.0.1:${port}`);
+  }
+
+  const url = new URL(request.url);
+  if (url.hostname === "127.0.0.1" || url.hostname === "localhost") {
+    url.protocol = "http:";
+  }
+  url.pathname = pathname;
+  url.search = "";
+  url.hash = "";
+  return url;
+}
+
 function isRoutineAuthRead(pathname: string, method: string) {
   if (method !== "GET") return false;
   return (
@@ -171,7 +196,7 @@ async function checkManualIpBlock(
 
   try {
     const response = await fetch(
-      new URL("/api/internal/ip-blocklist/check", request.url),
+      getInternalAccessUrl(request, "/api/internal/ip-blocklist/check"),
       {
         method: "POST",
         headers: {
@@ -235,7 +260,7 @@ function queueAccessLog(
     ...payload,
   });
 
-  const writePromise = fetch(new URL("/api/internal/access-log", request.url), {
+  const writePromise = fetch(getInternalAccessUrl(request, "/api/internal/access-log"), {
     method: "POST",
     headers: {
       "content-type": "application/json",