crafty-controller: changelog + report for healthcheck fix (route un-withheld; 502 backend-scheme tracked separately)

2026-06-26 09:56:52 +02:00
parent 68ce009f19
commit 9abd392247
2 changed files with 71 additions and 46 deletions
@@ -1,5 +1,25 @@
 # Changelog

+## 2026-06-26 — crafty-controller healthcheck fix (curl-absent + http-vs-TLS probe)
+- **crafty-controller**: container was permanently `unhealthy` → route withheld (`routeUnpublished`).
+  Two independent healthcheck root causes, both fixed in one change:
+  - **Docker healthcheck** ran `curl -fk https://localhost:8443`, but the `crafty-4:4.4.8` image has
+    **no `curl` and no `wget`** (`exec: "curl": not found`, FailingStreak 150). Replaced with a
+    dependency-free **python3 TLS-socket** liveness probe (`/usr/bin/python3` is present): completes a
+    TLS handshake to `127.0.0.1:8443` (unverified context mirrors the old `-k`; Crafty's cert is
+    self-signed). `start_period` 30s → 60s for cold-boot headroom (cert gen + migrations).
+  - **Controller-side probe** (`.felhom.yml healthcheck.checks`) was `type: http` against Crafty's
+    **TLS-only** 8443 → `probeHTTP` sent plaintext HTTP, got a TLS record → `HealthProbe.Healthy=false`,
+    which `manager.go` re-applies to override Docker's verdict back to `unhealthy`. Changed `http` →
+    `tcp` (`probeTCP` dial succeeds against a TLS listener). Both layers had to change together.
+  - Live-validated on guest 9201 (`demo-felhom`): synced → recreated via the update path → Docker
+    `State.Health: healthy` (ExitCode 0), `health_probe.healthy: true` (tcp :8443, 5ms), http-vs-TLS
+    WARNs stopped, stable green 3+ min, Traefik now **publishes** the route (`crafty-controller@docker`).
+  - **Known follow-up (separate, out of this fix's scope):** the public URL still returns **502** — a
+    distinct pre-existing bug the un-withheld route exposed: Traefik proxies `http://…:8443` to Crafty's
+    HTTPS-only backend. Needs a Traefik HTTPS-backend + self-signed `serversTransport`
+    (`insecureSkipVerify`) in the controller-generated Traefik config — tracked separately.
+
 ## 2026-06-23 — gokapi: index redirect + admin username display
 - **gokapi**: seed `RedirectUrl` repointed from Gokapi's GitHub default → `https://${SUBDOMAIN}.${DOMAIN}/admin`.
  Gokapi's bare root `/` redirects to `RedirectUrl`; the controller's "Megnyitás" link is always the bare