docker – reverse proxy nginx not loading content

i’m trying to set-up a reverse proxy with nginx under docker to be able to access “backend” devices (nas login page, router login page) through different location directives and proxy_pass but i can’t figure it out.
my actual *.conf (using a specific apps.conf)

server {
listen 80;
server_name DDNS_NAME LOCAL_DOCKER_HOST;
location / {
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    access_log /var/log/nginx/access_log.txt;
    error_log /var/log/nginx/error_log.txt;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";
    server_name DDNS_NAME LOCAL_DOCKER_HOST;
    ssl_certificate xxx;
    ssl_certificate_key xxx;
    location / {
        proxy_pass http://LOCAL_DOCKER_HOST:9000/; #portainer
    }
    location /NAS {
        proxy_pass http://NAS_LOCAL; #nas webUI
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

the location / works 95%, because it actually loads the Portainer interface, but then i’m not able to establish console connection inside it, seems that Portainer uses a different port/socket/whatever when connecting to container’s console… anyway, i can survive without it.

the damn part is location /NAS… that’s a curl -L DDNS_NAME/NAS -vvvv

> GET /NAS HTTP/1.1
> Host: DDNS_NAME
> User-Agent: curl/7.68.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Server: nginx/1.19.5
< Date: Tue, 01 Dec 2020 16:23:02 GMT
< Content-Type: text/html; charset=iso-8859-1
< Content-Length: 212
< Connection: keep-alive
< Location: /r51201,/desktop,/login.html
<
* Ignoring the response-body

* Connected to DDNS_NAME (PUBLIC_IP) port 443 (#1)
> GET /r51201,/desktop,/login.html HTTP/1.1
> Host: DDNS_NAME
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Server: nginx/1.19.5
< Date: Tue, 01 Dec 2020 16:23:02 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 19
< Connection: keep-alive
< Cache-Control: max-age=31536000
< X-Content-Type-Options: nosniff
< X-Xss-Protection: 1; mode=block
<
404 page not found

it gets answer from the right device (so the initial proxy works) because it get redirect to */r51201,/desktop,/login.html but the browser (or curl -L) tries to load resources from DDNS_NAME/r51201,/desktop,/login.html, and of course i get a 404. i’m struggling with this for weeks, trying infinite combinations of proxy_set_header but maybe i cannot find the right one.

of course i adjusted outputs to hide personal informations and i have more than one location i would like to reach, but all do the same so i reported just one

thanks in advance