Assume nothing! Test every little assumption and you’ll find the problem. Some things to get you started:
Does the “app” domain resolve to the app container’s IP from within the nginx container?
Can you proxy_pass to the host:port directly rather than using an upstream definition? If not, what about IP:port?
Is the http(s) connection to the server (demo.example.com) actually going to your nginx instance? Shut it down and see if it changes.
If it works locally on 80, can you get it to work on the VPS on 80?
Are you using the exact same docker-compose.yaml file for this as locally? If not, what’s different?
Are you building the image? If so, are you incrementing the version number of the build so it gets updated?
Is there a firewall running on the host OS? If so, is it somehow interfering? Disable it and see.
While not a direct solution to your problem, I no longer manually configure my reverse proxies at all now and use auto-configuring ones instead. The nginx-proxy image is great, along with it’s ACME companion image for automatic SSL cert generation with certbot - you’ll be up and running in under 30 mins. I used that for a long time and it was great.
I’ve since moved to using Traefik as it’s more flexible and offers more features, but it’s a bit more involved to configure (simple, but the additional flexibility means everything requires more config).
That way you just bring up your container and the reverse proxy pulls meta-data from it (e.g. host to map/certbot email) and off it goes.