How Hardcoded Private IPs Killed Our Production Frontend

A hardcoded private IP buried in the frontend source was silently breaking all external access.

Background

We had an internal ERP system (Vite + React frontend, Express backend) that worked perfectly on the LAN. When we tried to expose it externally, nothing worked.

The Problem

Private IPs were hardcoded throughout the frontend:

const BASE_URL = 'http://192.168.x.x:8520/api';

LAN browsers could reach these IPs. External browsers could not. Even after vite build, these IPs were baked into the bundled JS.

The Fix

1. Replaced all hardcoded IPs with relative paths (/api)
2. Created .env.production with VITE_API_URL=/api/v1
3. Changed nginx from proxying to vite dev server → serving built static files with try_files
4. Built and deployed properly

Vite Dev Proxy Trap

server.proxy in vite.config.ts only works during npm run dev. It has zero effect on production builds.

Lessons

1. Never hardcode private IPs in frontend code
2. Never use Vite dev server in production
3. server.proxy is dev-only
4. LAN testing is not real testing