--listen-addr /ip4/0.0.0.0/tcp/9944/ws breaks polkadot.js

Question

I am trying to get my westend boot nodes to also serve polkadot.js

Following https://github.com/paritytech/polkadot/issues/6208, there is a recommendation [requirement?] to run polkadot with Node was started with --listen-addr=/ip4/0.0.0.0/tcp/30334/ws flag.

The boot node runs in docker compose as follows:

docker-compose-westend-boot.yml

services:

  westend-boot:
    container_name: westend-boot-1
    image: parity/polkadot
    restart: on-failure
    ports:
      - "33012:33012" # p2p port
      - "33013:33013" # prometheus port
      - "33014:33014" # JSON-RPC HTTP server
      - "33015:33015" # JSON-RPC WS server
    volumes:
      - /var/westend/boot-1:/data
    command: [
      "--chain", "westend",
      # "--validator", # not for RPC node!
      "--name", "METASPAN-BOOT",
      "--base-path", "/data",
      # boot nodes need 10, RPC nodes should be 'archive'
      "--pruning", "10",
      # "--port", "33012", # p2p protocol TCP port, default 30333
      "--listen-addr", "/ip4/0.0.0.0/tcp/33012",
      "--public-addr", "/ip4/195.144.22.133/tcp/33012",
      "--prometheus-port", "33013", # default 9900
      "--prometheus-external",
      # RPC port
      "--rpc-external",
      "--rpc-port", "33014", # HTTP RPC server TCP port, default 9933
      "--rpc-methods", "safe",
      "--rpc-cors", "all",
      # WS for polkadot.js etc
      "--ws-external",
      "--ws-port", "33015",  # WebSockets RPC server TCP port, default 9944

      # =============================================
      # this next line breaks polkadot.js wss:// config...!
      # but is needed for command line sync...!
      # "--listen-addr", "/ip4/0.0.0.0/tcp/33015/ws",
      # =============================================

      "--public-addr", "/ip4/195.144.22.133/tcp/33015/ws",
      # RPC node
    ]

Adding "--listen-addr", "/ip4/0.0.0.0/tcp/33015/ws", seems to enable command-line sync as per #6208. The test is this command will find a peer...

polkadot --no-hardware-benchmarks --no-mdns \
  --chain westend \
  --reserved-only \
  --reserved-nodes /dns/boot-195.144.22.133/tcp/33015/ws/p2p/12D3KooWNTau7iG4G9cUJSwwt2QJP1W88pUf2SgqsHjRU2RL8pfa

However, that line breaks https://polkadot.js.org/apps/?rpc=wss://ibp-rpc.metaspan.io/kusama

Are these configs mutually exclusive?

Note, the ws port is proxied in nginx as follows:

upstream rpc_ws_westend {
  server 192.168.1.123:33015;
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

server {
  # external wss://ibp-rpc.metaspan.io/${chain} should arrive here...
  # -> ___.___._.__:443 router external
  # -> 192.168.1.123:443 docker external
  # -> 0.0.0.0:443       docker internal
  listen *:443 ssl;
  server_name ibp-rpc.metaspan.io;
  ssl_certificate     /etc/letsencrypt/live/ibp-rpc.metaspan.io/fullchain.pem; 
  ssl_certificate_key /etc/letsencrypt/live/ibp-rpc.metaspan.io/privkey.pem;

  location /westend {
    proxy_pass http://rpc_ws_westend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade; # "Upgrade";
    proxy_set_header Host $host;
  }
}