fix(smoke): probe Umami health inside container #284

Merged

pdurlej merged 1 commit from codex/f2/umami-health-probe-fix into main

2026-05-14 15:44:26 +02:00

codex commented

2026-05-14 12:08:56 +02:00

Collaborator

Canary status: approve_merge — Forgejo checks green: base-is-main, platformctl plan, python-ci 3.11/3.12/3.13, canary-required.

Canary Context Pack

Product story

Umami should be a clean F2 no-op smoke target. Run #902 proved apply was already noop/OK, but health failed because the smoke curled the Tailnet-protected public URL from the runner path and received 403.

What changed

tests/smoke.sh now supports explicit docker-exec://<container>:<port>/<path> health URLs for services whose valid health endpoint is only reliable inside the container namespace.
modules/umami/module.yaml now points its health probe at docker-exec://home-platform-umami-1:3000/api/heartbeat.

Why it changed

The real Umami healthcheck is already the container-local /api/heartbeat endpoint. Traefik correctly returns 403 externally because umami.pdurlej.com is protected by ts-allowlist@file; that 403 is not a service failure.

Files touched

tests/smoke.sh
modules/umami/module.yaml

Relevant context

PR #282 dispatch: prompts/codex-260-fix-plus-umami-probe-2026-05-14.md
ADR-0018: agentic-first systems fix root causes, not recurring false fire signals
Run #902 artifact: umami.health.json reported health-http:FAIL-403-vs-expected-200

Runtime evidence

Container-local probe on RS2000: docker exec home-platform-umami-1 wget ... http://127.0.0.1:3000/api/heartbeat returns HTTP 200 and {"ok":true}.
Traefik URL: https://umami.pdurlej.com/api/heartbeat returns HTTP 403, as expected for Tailnet-gated exposure.
Local smoke after patch: health-http:PASS-200 for umami.
Regression check: mirotalk-sfu normal URL probe still reports health-http:PASS-200.

Known constraints

The docker-exec:// URL is intentionally explicit per-module behavior. It does not change normal HTTP probes and does not expose Umami publicly.

Explicit out-of-scope

No #260 runner-pickup fix in this PR. No DB mutation. No Forgejo restart. No exposure change.

Requested decision

Merge Phase A after CI/review; then trigger the Umami no-op smoke to verify health-http:PASS-200 in workflow evidence.

Merge blockers

Any regression in tests/smoke.sh, invalid module schema, or concern that docker-exec:// should be represented differently in schema/docs.

Spec sources read

prompts/codex-260-fix-plus-umami-probe-2026-05-14.md — Phase A/B dispatch
decisions/0018-agentic-first-fix-root-causes.md — governance framing
modules/umami/module.yaml — failing probe spec
modules/umami/runbook.md — live healthcheck and exposure notes
tests/smoke.sh — health-http implementation
control-plane/platformctl/health.py — confirms health delegates smoke checks to tests/smoke.sh
/Users/pd/Downloads/platformctl-auto-apply-902/evidence/umami.health.json — run #902 failure evidence

Validation

bash -n tests/smoke.sh — pass
uv run --project control-plane python -m platformctl.cli validate --strict-v2 modules/umami/module.yaml — pass
PLATFORMCTL_SMOKE_REMOTE_MODE=skip tests/smoke.sh --json umami — health-http:PASS-200
PLATFORMCTL_SMOKE_REMOTE_MODE=skip tests/smoke.sh --json mirotalk-sfu — health-http:PASS-200
uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_smoke.py -q — 30 passed

Refs #142
Refs #260

Canary status: approve_merge — Forgejo checks green: base-is-main, platformctl plan, python-ci 3.11/3.12/3.13, canary-required. ## Canary Context Pack ### Product story Umami should be a clean F2 no-op smoke target. Run #902 proved apply was already noop/OK, but health failed because the smoke curled the Tailnet-protected public URL from the runner path and received 403. ### What changed - `tests/smoke.sh` now supports explicit `docker-exec://<container>:<port>/<path>` health URLs for services whose valid health endpoint is only reliable inside the container namespace. - `modules/umami/module.yaml` now points its health probe at `docker-exec://home-platform-umami-1:3000/api/heartbeat`. ### Why it changed The real Umami healthcheck is already the container-local `/api/heartbeat` endpoint. Traefik correctly returns 403 externally because `umami.pdurlej.com` is protected by `ts-allowlist@file`; that 403 is not a service failure. ### Files touched - `tests/smoke.sh` - `modules/umami/module.yaml` ### Relevant context - PR #282 dispatch: `prompts/codex-260-fix-plus-umami-probe-2026-05-14.md` - ADR-0018: agentic-first systems fix root causes, not recurring false fire signals - Run #902 artifact: `umami.health.json` reported `health-http:FAIL-403-vs-expected-200` ### Runtime evidence - Container-local probe on RS2000: `docker exec home-platform-umami-1 wget ... http://127.0.0.1:3000/api/heartbeat` returns HTTP 200 and `{"ok":true}`. - Traefik URL: `https://umami.pdurlej.com/api/heartbeat` returns HTTP 403, as expected for Tailnet-gated exposure. - Local smoke after patch: `health-http:PASS-200` for `umami`. - Regression check: `mirotalk-sfu` normal URL probe still reports `health-http:PASS-200`. ### Known constraints The `docker-exec://` URL is intentionally explicit per-module behavior. It does not change normal HTTP probes and does not expose Umami publicly. ### Explicit out-of-scope No #260 runner-pickup fix in this PR. No DB mutation. No Forgejo restart. No exposure change. ### Requested decision Merge Phase A after CI/review; then trigger the Umami no-op smoke to verify `health-http:PASS-200` in workflow evidence. ### Merge blockers Any regression in `tests/smoke.sh`, invalid module schema, or concern that `docker-exec://` should be represented differently in schema/docs. ## Spec sources read - `prompts/codex-260-fix-plus-umami-probe-2026-05-14.md` — Phase A/B dispatch - `decisions/0018-agentic-first-fix-root-causes.md` — governance framing - `modules/umami/module.yaml` — failing probe spec - `modules/umami/runbook.md` — live healthcheck and exposure notes - `tests/smoke.sh` — health-http implementation - `control-plane/platformctl/health.py` — confirms health delegates smoke checks to `tests/smoke.sh` - `/Users/pd/Downloads/platformctl-auto-apply-902/evidence/umami.health.json` — run #902 failure evidence ## Validation - `bash -n tests/smoke.sh` — pass - `uv run --project control-plane python -m platformctl.cli validate --strict-v2 modules/umami/module.yaml` — pass - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip tests/smoke.sh --json umami` — `health-http:PASS-200` - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip tests/smoke.sh --json mirotalk-sfu` — `health-http:PASS-200` - `uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_smoke.py -q` — 30 passed Refs #142 Refs #260

codex added the

tier/lite

label

2026-05-14 12:08:56 +02:00

codex added 1 commit

2026-05-14 12:08:56 +02:00