Update documentation for unified Docker image

Update guides, configuration reference, architecture notes, and the
domain glossary to reflect the single proxy-routed image: remove the
public/proxy endpoint connection fields, document that all requests flow
through the proxy server (which requires network access to the
database), and add the Proxy Server glossary term.

Author: kmcginnes

CONTEXT.md

@@ -13,8 +13,8 @@ A directed relationship between two vertices (source → target), with a type an
 _Avoid_: Relationship, link
 
 **Connection**:
-A saved database profile — the URL, query engine, authentication settings, and proxy routing needed to reach a graph database. Users create and manage these in the UI.
-_Avoid_: Configuration (legacy term being phased out — previously bundled connection + schema + Styles into one object)
+A saved database profile — the graph database endpoint URL (`graphDbUrl`), query language, and optional IAM authentication settings. The client always reaches the database through the same-origin **Proxy Server**, so no proxy endpoint is configured. Users create and manage these in the UI.
+_Avoid_: Configuration (legacy term being phased out — previously bundled connection + schema + Styles into one object); proxy endpoint / `proxyConnection` (removed — see ADR `unify-docker-image-remove-sagemaker-variant`)
 
 **Active Connection**:
 The one Connection a single browser tab is currently exploring — what the entire app reads to decide which Schema, Session, and queries are in play. Held per-tab (sessionStorage): it survives that tab's reload but dies with the tab, and one tab activating a Connection never changes another tab's Active Connection.
@@ -86,6 +86,10 @@ _Avoid_: Save state (ambiguous with Session)
 The UI element in the nav bar (after the page title) that renders Persistence Status. It surfaces only on `failed` — a standing danger "Changes not saved" button — and stays absent at `idle` and `saving`. Clicking it opens a dialog showing the raw failure records (key, reason, attempt count, last attempt, and the underlying error's name/message/cause) in a read-only JSON editor. The dialog offers to save the configuration to a file via `saveLocalForageToFile` (`core/StateProvider/localDb.ts`) when storage is full (quota) — IndexedDB is still readable then — but not when storage is inaccessible (private mode, blocked), since the database never opened and there is nothing to read. Recovery scope is retry (transient failures) plus that backup (terminal-quota failures) — it does not guarantee the write eventually lands.
 _Avoid_: Save-status indicator
 
+**Proxy Server**:
+The Node.js server that serves the frontend (mounted at `/explorer`) and proxies all database requests (mounted at `/`). The client resolves API endpoints relative to its own origin via `apiUrl()` — `../endpoint` from the static mount — so the frontend and proxy are always same-origin. This means every database request routes through the Proxy Server, which has network access to the database and handles SigV4 signing. See ADR `unify-docker-image-remove-sagemaker-variant`.
+_Avoid_: proxy endpoint URL (no longer user-configured)
+
 ## Relationships
 
 - Each browser tab has at most one **Active Connection**; different tabs may have different ones
@@ -120,3 +124,4 @@ _Avoid_: Save-status indicator
 - "Node" means **Vertex** in code but is the preferred UI term for property graphs — resolved: use **Vertex** in code, "node" in UI copy.
 - "Attribute" vs "Property" — resolved: **Property** is canonical, "attribute" is legacy code term being phased out.
 - "Active connection" meant a single shared per-origin value, but the app consumed it as if it were per-tab — resolved: **Active Connection** is per-tab (sessionStorage), **Last Active Connection** is the shared persisted breadcrumb. The legacy `activeConfigurationAtom` / `active-configuration` key is reused as the breadcrumb.
+- Connection URL field — `url` and `proxyConnection` are legacy fields that survive only in `LegacyConnectionConfig` and are migrated at read time to the canonical `graphDbUrl` (see `migrateLegacyConnection`, ADR `unify-docker-image-remove-sagemaker-variant`). Use `graphDbUrl` in code.

docs/architecture.md

@@ -13,15 +13,16 @@ Graph Explorer is a client-heavy web application with a thin backend proxy. The
 graph LR
     Browser["Browser\n(React)"] -- HTTP --> Proxy["Proxy Server\n(Express)"]
     Proxy -- HTTP --> DB["Graph Database\n(Neptune, etc.)"]
-    Browser -. direct .-> DB
     Browser -- persistence --> IDB["IndexedDB\n(localforage)"]
 ```
 
-The React client constructs queries and sends them through the proxy server, which forwards requests to the graph database. When connecting to Amazon Neptune, the proxy signs requests with AWS SigV4 credentials. For non-Neptune databases, the proxy is optional — the client can connect directly to a publicly accessible endpoint (shown as the dotted line above).
+The React client constructs queries and sends them through the proxy server using relative URLs, which forwards requests to the graph database. When connecting to Amazon Neptune, the proxy signs requests with AWS SigV4 credentials.
 
 The proxy does not store any user data — all preferences, connections, and query history live in the browser's IndexedDB.
 
-This split exists because browsers cannot perform SigV4 signing directly (it requires AWS credentials that should not be exposed to the client), and because the proxy can run inside a VPC alongside the database while the browser runs outside it.
+This architecture allows the app to work behind any reverse proxy (SageMaker, custom paths) without build-time configuration, since the client resolves API endpoints relative to its own location. The proxy can run inside a VPC alongside the database while the browser runs outside it.
+
+Because all requests flow through the proxy, the server must have network access to the target database. If the server is in a restricted network (e.g., a private subnet with no NAT gateway), it will not be able to reach databases outside that network even if the user's browser could reach them directly.
 
 ## Monorepo Structure
 

docs/features/connections.md

@@ -10,14 +10,11 @@ For guides on connecting to specific databases, see [Connecting to databases](..
 
 - **Name:** Enter a name for your connection (e.g., `MyNeptuneCluster`).
 - **Query Language:** Choose a query language that corresponds to your graph database.
-- **Public or proxy endpoint:** Provide the publicly accessible endpoint URL for a graph database, e.g., Gremlin Server. If connecting to Amazon Neptune, then provide a proxy endpoint URL that is accessible from outside the VPC, e.g., EC2.
-  - **Note:** For connecting to Amazon Neptune, ensure that the graph connection URL is in the format `https://[NEPTUNE_ENDPOINT]:8182`, and that the proxy endpoint URL is either `https://[EC2_PUBLIC_HOSTNAME]:443` or `http://[EC2_PUBLIC_HOSTNAME]:80`, depending on the protocol used. Ensure that you don't end either of the URLs with `/`.
-- **Using proxy server:** Check this box if using a proxy endpoint.
-- **Graph connection URL:** Provide the endpoint for the graph database
-- **AWS IAM Auth Enabled:** Check this box if connecting to Amazon Neptune using IAM Auth and SigV4 signed requests
-- **Service Type:** Choose the service type
-- **AWS Region:** Specify the AWS region where the Neptune cluster is hosted (e.g., us-east-1)
-- **Fetch Timeout:** Specify the timeout for the fetch request
+- **Graph Connection URL:** Provide the endpoint URL for your graph database (e.g., `https://[NEPTUNE_ENDPOINT]:8182`). Ensure that the URL does not end with `/`.
+- **AWS IAM Auth Enabled:** Check this box if connecting to Amazon Neptune using IAM Auth and SigV4 signed requests.
+- **Service Type:** Choose the service type (`neptune-db` or `neptune-graph`).
+- **AWS Region:** Specify the AWS region where the Neptune cluster is hosted (e.g., us-east-1).
+- **Fetch Timeout:** Specify the timeout for the fetch request.
 - **Neighbor Expansion Limit:** Specify the default limit for neighbor expansion. This will override the app setting for neighbor expansion.
 
 ## Available Connections

docs/guides/connecting-to-gremlin-server.md

@@ -15,8 +15,6 @@ Then open Graph Explorer and add a new connection with the following settings:
 
 - Name: `Gremlin Server`
 - Query Language: `Gremlin`
-- Public or Proxy Endpoint: `https://localhost`
-- Using Proxy Server: `true`
 - Graph Connection URL: `http://localhost:8182`
 
 ## Enable REST

docs/guides/connecting-to-neptune.md

@@ -8,8 +8,6 @@ Graph Explorer connects to Amazon Neptune through its proxy server, which forwar
 
 - Name: `My Neptune Cluster`
 - Query Language: Choose the query language for your graph
-- Public or Proxy Endpoint: `https://localhost` (or wherever Graph Explorer is hosted)
-- Using Proxy Server: `true`
 - Graph Connection URL: `https://{your-cluster-endpoint}:8182`
 - AWS IAM Auth Enabled: `true` if IAM authentication is enabled on your cluster
 - Service Type: `neptune-db` (or `neptune-graph` for Neptune Analytics)

docs/guides/deploy-to-ecs-fargate.md

@@ -107,14 +107,6 @@ After the request is processed, the console will return you to your certificate
              "name": "IAM",
              "value": "false"
            },
-           {
-             "name": "USING_PROXY_SERVER",
-             "value": "true"
-           },
-           {
-             "name": "PUBLIC_OR_PROXY_ENDPOINT",
-             "value": "https://{FQDN_from_step3}"
-           },
            {
              "name": "HOST",
              "value": "localhost"
@@ -164,7 +156,6 @@ After the request is processed, the console will return you to your certificate
      - `GRAPH_TYPE`: The query language for your initial connection.
      - `IAM`: Set this to `true` to use SigV4 signed requests, if your Neptune cluster has IAM db authentication enabled.
      - `GRAPH_CONNECTION_URL`: Set this as `https://{NEPTUNE_ENDPOINT}:8182`.
-     - `PUBLIC_OR_PROXY_ENDPOINT`: Set this as `https://{Domain name set in Step 5 of "Request an ACM Public Certificate"}`.
      - `SERVICE_TYPE`: Set this as `neptune-db` for Neptune database or `neptune-graph` for Neptune Analytics.
 6. Click **Create**.
 

docs/guides/deploy-to-sagemaker.md

@@ -14,6 +14,12 @@ When the notebook has been started and is in "Ready" state, you can access Graph
 https://graph-explorer-notebook-name.notebook.us-west-2.sagemaker.aws/proxy/9250/explorer/
 ```
 
+## Network Requirements
+
+All database requests from Graph Explorer are routed through the proxy server running on the SageMaker notebook instance. This means the instance must have network access to any database you want to explore.
+
+If your notebook instance is in a private subnet without a NAT gateway or internet gateway, it will not be able to reach databases outside the VPC. To connect to external databases, ensure the instance has the appropriate network routing (VPC peering, NAT gateway, transit gateway, etc.).
+
 ## Minimum Database Permissions
 
 By default, the permission policy for the IAM role of the SageMaker instance will have full access to the Neptune Database or Neptune Analytics instance. This means queries executed within Graph Explorer could contain mutations.

docs/guides/deploy-with-docker.md

@@ -9,7 +9,7 @@ You can find the latest version of the image on
 
 > [!NOTE]
 >
-> Make sure to use the version of the image that does not include `sagemaker` in the tag.
+> Both the regular and `sagemaker-*` image tags contain the same image. You can use either.
 
 ## Prerequisites
 

docs/references/configuration.md

@@ -8,16 +8,6 @@ All environment variables for configuring Graph Explorer, organized by concern.
 
 These variables control server behavior, networking, and security.
 
-### `GRAPH_EXP_ENV_ROOT_FOLDER`
-
-Base path used to serve the `graph-explorer` front end application.
-
-Example: `/explorer`
-
-- Optional
-- Default: `/`
-- Type: `string`
-
 ### `HOST`
 
 The public hostname of the server. This is used to generate the self-signed SSL certificate at container startup.
@@ -115,6 +105,14 @@ Override path for the folder containing `.env` and `defaultConnection.json`. Whe
 - Default: `<client root>` (`packages/graph-explorer`)
 - Type: `string`
 
+### `NEPTUNE_NOTEBOOK`
+
+Runtime convenience preset for SageMaker/Jupyter deployments. When set to `true`, configures port 9250, cloudwatch logging, and disables SSL automatically.
+
+- Optional
+- Default: not set
+- Type: `boolean`
+
 ## Default Connection
 
 To provide a default connection such that initial loads of Graph Explorer always result with the same starting connection, modify the `docker run ...` command to either take in a JSON configuration or runtime environment variables. If you provide both a JSON configuration and environmental variables, the JSON will be prioritized.
@@ -124,19 +122,16 @@ To provide a default connection such that initial loads of Graph Explorer always
 These are the valid environment variables used for the default connection, their defaults, and their descriptions.
 
 - Required:
-  - `PUBLIC_OR_PROXY_ENDPOINT` - `None`
+  - `GRAPH_CONNECTION_URL` - `None` - The URL of the graph database endpoint.
 - Optional
   - `GRAPH_TYPE` - `None` - If not specified, multiple connections will be created for every available query language.
-  - `USING_PROXY_SERVER` - `False`
   - `IAM` - `False`
   - `GRAPH_EXP_HTTPS_CONNECTION` - `True` - Controls whether Graph Explorer uses SSL or not
   - `PROXY_SERVER_HTTPS_CONNECTION` - `True` - Controls whether the server uses SSL or not
   - `GRAPH_EXP_FETCH_REQUEST_TIMEOUT` - `240000` - Controls the timeout for the fetch request. Measured in milliseconds (i.e. 240000 is 240 seconds or 4 minutes).
   - `GRAPH_EXP_NODE_EXPANSION_LIMIT` - `None` - Controls the limit for node counts and expansion queries.
 - Conditionally Required:
-  - Required if `USING_PROXY_SERVER=True`
-    - `GRAPH_CONNECTION_URL` - `None`
-  - Required if `USING_PROXY_SERVER=True` and `IAM=True`
+  - Required if `IAM=True`
     - `AWS_REGION` - `None`
     - `SERVICE_TYPE` - `neptune-db`, Set this as `neptune-db` for Neptune database or `neptune-graph` for Neptune Analytics.
 
@@ -146,9 +141,7 @@ First, create a `config.json` file containing values for the connection attribut
 
 ```json
 {
-  "PUBLIC_OR_PROXY_ENDPOINT": "https://public-endpoint",
   "GRAPH_CONNECTION_URL": "https://{your-cluster-id}.us-west-2.neptune.amazonaws.com:8182",
-  "USING_PROXY_SERVER": true,
   "IAM": true,
   "SERVICE_TYPE": "neptune-db",
   "AWS_REGION": "us-west-2",
@@ -178,11 +171,9 @@ Provide the desired connection variables directly to the `docker run` command, a
 ```bash
 docker run -p 80:80 -p 443:443 \
  --env HOST={hostname-or-ip-address} \
- --env PUBLIC_OR_PROXY_ENDPOINT=https://public-endpoint \
- --env GRAPH_TYPE=gremlin \
- --env USING_PROXY_SERVER=true \
- --env IAM=false \
  --env GRAPH_CONNECTION_URL=https://{your-cluster-id}.us-west-2.neptune.amazonaws.com:8182 \
+ --env GRAPH_TYPE=gremlin \
+ --env IAM=true \
  --env AWS_REGION=us-west-2 \
  --env SERVICE_TYPE=neptune-db \
  --env PROXY_SERVER_HTTPS_CONNECTION=true \