From b85c12e8b9a2f455040aa8a8a614595e98c256e6 Mon Sep 17 00:00:00 2001 From: nexxo Date: Mon, 27 Jul 2026 14:46:47 +0200 Subject: [PATCH] Give the readiness probe long enough for a restart to finish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway is restarted twice in a deployment — once by `up -d`, then again after the hub whose network namespace it lives in — and `docker compose exec` into a container that is still coming up fails outright rather than waiting. Twenty seconds did not cover that, so the first run of the new probe reported a gateway that answers as down, and the resolver stayed out of client configs for one more deployment. The health site also now binds the hub address instead of only matching on it. Nothing was published either way, but the file should do what its comment says. Co-Authored-By: Claude Opus 5 --- deploy/update.sh | 7 ++++++- docker/caddy/vpn.Caddyfile | 5 +++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/deploy/update.sh b/deploy/update.sh index 8a8aaf1..0cf4121 100755 --- a/deploy/update.sh +++ b/deploy/update.sh @@ -159,7 +159,12 @@ reconcile_vpn_readiness() { port="$(sed -n 's/^VPN_HEALTH_PORT=//p' .env | tail -1)" health="http://${hub}:${port:-8081}/healthz" - for _ in $(seq 1 10); do + # Long enough for a restart to finish. These containers are restarted twice + # in a deployment — once by `up -d`, then again after the hub they live + # inside — and `docker compose exec` into one that is still coming up fails + # outright rather than waiting. Twenty seconds was not enough for that, and + # the run then reported a healthy gateway as down. + for _ in $(seq 1 30); do if docker compose exec -T vpn-gateway sh -c \ "wget -q --spider '$health' 2>/dev/null || wget -q -O /dev/null '$health' 2>/dev/null" >/dev/null 2>&1; then vpn_ready=true diff --git a/docker/caddy/vpn.Caddyfile b/docker/caddy/vpn.Caddyfile index f6df4ea..cf115b5 100644 --- a/docker/caddy/vpn.Caddyfile +++ b/docker/caddy/vpn.Caddyfile @@ -43,6 +43,11 @@ https://{$VPN_INTERNAL_HOST}:443 { # published. Caddy also refuses to start when the certificate above cannot be # read, so a health port that answers proves the whole file loaded. http://{$VPN_HUB_ADDRESS}:{$VPN_HEALTH_PORT:8081} { + # bind, not merely a matching hostname: without it Caddy listens on every + # interface in the namespace and only MATCHES on the address. Nothing is + # published, so it was not reachable from outside either way — but "on the + # hub address and nowhere else" should be what the file actually does. + bind {$VPN_HUB_ADDRESS} respond /healthz 204 respond 404 }