Take a restarting Kibana replica out of the proxy rotation

environments/elk-ror/conf/kbn/kbn-proxy-nginx.conf

@@ -1,8 +1,12 @@
 events { }
 
 http {
+  # `kbn-ror` resolves to both Kibana replicas, so this one line is two round-robin peers.
+  # max_fails=0 keeps a peer in rotation after a failed request. A settings change makes both
+  # replicas answer 503 at once. With the default max_fails=1, that ejects both peers and nginx
+  # answers 502 for the next ten seconds, also after the replicas recover.
   upstream kbn-ror {
-    server kbn-ror:5601;
+    server kbn-ror:5601 max_fails=0;
   }
 
   server {
@@ -22,6 +26,18 @@ http {
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_ssl_verify off;  # Disable SSL verification for internal requests (only if Kibana uses self-signed certs)
+
+      # A restarting Kibana replica drops packets, so a connection to it hangs instead of failing.
+      # The default 60s is longer than every Cypress timeout. 2s is far above a healthy connect
+      # on the container network and below the 10s cy.wait() timeout.
+      proxy_connect_timeout 2s;
+
+      # Retry on the other replica when this one cannot take the request. A Kibana that is
+      # listening but still starting answers 503, so http_503 is a retry condition too.
+      # Two tries, one per replica. 5s covers two 2s connect timeouts and stays below cy.wait().
+      proxy_next_upstream error timeout http_502 http_503 http_504;
+      proxy_next_upstream_tries 2;
+      proxy_next_upstream_timeout 5s;
     }
   }
-}
+}