fix(smoke): probe Umami through Tailnet route #285

Merged

pdurlej merged 1 commit from codex/f2/umami-tailnet-probe-fix into main

2026-05-15 16:34:35 +02:00

codex commented

2026-05-14 15:53:51 +02:00

Collaborator

Canary status: approve_merge — Forgejo checks green: base-is-main, platformctl plan, python-ci 3.11/3.12/3.13, canary-required.

Canary Context Pack

Product story

Umami should be a clean F2 no-op smoke target. PR #284 fixed the public 403 diagnosis but chose docker-exec://, which fails in the real runner because platform-host-agent correctly denies docker exec. This PR replaces that with a Tailnet route probe that works under the deploy runner without widening host-agent permissions.

What changed

tests/smoke.sh now supports explicit tailnet-https://<host>/<path> health URLs.
tailnet-https:// probes use curl --resolve <host>:443:<platform host Tailnet IP> so Traefik sees a Tailnet source and preserves Host/SNI routing.
modules/umami/module.yaml now uses tailnet-https://umami.pdurlej.com/api/heartbeat.

Why it changed

Run #919 showed docker-exec:// returned health-http:FAIL-000-vs-expected-200 in the workflow. Root cause: runner smoke uses PLATFORMCTL_SMOKE_SSH_USER=platform-host-agent, and the forced-command wrapper allows docker inspect / compose operations, not docker exec. That denial is correct security behavior.

Files touched

tests/smoke.sh
modules/umami/module.yaml

Relevant context

PR #284 — first Phase A attempt, merged, but workflow run #919 still failed with 000
PR #282 dispatch: prompts/codex-260-fix-plus-umami-probe-2026-05-14.md
ADR-0018: agentic-first systems fix root causes, not recurring false fire signals

Runtime evidence

curl --resolve umami.pdurlej.com:443:100.110.188.20 https://umami.pdurlej.com/api/heartbeat returns HTTP 200 as both root and forgejo-deploy on RS2000.
Default public route from RS2000 returns HTTP 403, matching the original failure.
platform-host-agent denies docker exec, explaining run #919's 000 after #284.
Local smoke after patch: health-http:PASS-200 for umami.
Regression check: mirotalk-sfu normal URL probe still reports health-http:PASS-200.

Known constraints

tailnet-https:// is an explicit per-module probe for Tailnet-gated HTTPS services. It does not change normal HTTP probes and does not expose Umami publicly.

Explicit out-of-scope

No #260 runner-pickup fix in this PR. No DB mutation. No Forgejo restart. No exposure change. No host-agent permission expansion.

Requested decision

Merge after CI/review; then trigger platformctl-auto-apply.yml with module=umami again and verify health-http:PASS-200 in workflow evidence.

Merge blockers

Any regression in tests/smoke.sh, invalid module schema, or concern that tailnet-https:// should be represented differently in schema/docs.

Spec sources read

prompts/codex-260-fix-plus-umami-probe-2026-05-14.md — Phase A/B dispatch
decisions/0018-agentic-first-fix-root-causes.md — governance framing
modules/umami/module.yaml — probe spec
modules/umami/runbook.md — healthcheck and exposure notes
tests/smoke.sh — health-http implementation
control-plane/platformctl/transport/tailscale.py — platform host Tailnet IP env mapping
control-plane/platformctl/health.py — confirms health delegates smoke checks to tests/smoke.sh
/tmp/platformctl-auto-apply-919/evidence/umami.health.json — run #919 failure evidence

Validation

bash -n tests/smoke.sh — pass
uv run --project control-plane python -m platformctl.cli validate --strict-v2 modules/umami/module.yaml — pass
PLATFORMCTL_SMOKE_REMOTE_MODE=skip PLATFORMCTL_RS2000_SSH_HOST=100.110.188.20 tests/smoke.sh --json umami — health-http:PASS-200
PLATFORMCTL_SMOKE_REMOTE_MODE=skip PLATFORMCTL_RS2000_SSH_HOST=100.110.188.20 tests/smoke.sh --json mirotalk-sfu — health-http:PASS-200
uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_smoke.py -q — 30 passed

Refs #142
Refs #260

Canary status: approve_merge — Forgejo checks green: base-is-main, platformctl plan, python-ci 3.11/3.12/3.13, canary-required. ## Canary Context Pack ### Product story Umami should be a clean F2 no-op smoke target. PR #284 fixed the public 403 diagnosis but chose `docker-exec://`, which fails in the real runner because `platform-host-agent` correctly denies `docker exec`. This PR replaces that with a Tailnet route probe that works under the deploy runner without widening host-agent permissions. ### What changed - `tests/smoke.sh` now supports explicit `tailnet-https://<host>/<path>` health URLs. - `tailnet-https://` probes use `curl --resolve <host>:443:<platform host Tailnet IP>` so Traefik sees a Tailnet source and preserves Host/SNI routing. - `modules/umami/module.yaml` now uses `tailnet-https://umami.pdurlej.com/api/heartbeat`. ### Why it changed Run #919 showed `docker-exec://` returned `health-http:FAIL-000-vs-expected-200` in the workflow. Root cause: runner smoke uses `PLATFORMCTL_SMOKE_SSH_USER=platform-host-agent`, and the forced-command wrapper allows `docker inspect` / compose operations, not `docker exec`. That denial is correct security behavior. ### Files touched - `tests/smoke.sh` - `modules/umami/module.yaml` ### Relevant context - PR #284 — first Phase A attempt, merged, but workflow run #919 still failed with `000` - PR #282 dispatch: `prompts/codex-260-fix-plus-umami-probe-2026-05-14.md` - ADR-0018: agentic-first systems fix root causes, not recurring false fire signals ### Runtime evidence - `curl --resolve umami.pdurlej.com:443:100.110.188.20 https://umami.pdurlej.com/api/heartbeat` returns HTTP 200 as both `root` and `forgejo-deploy` on RS2000. - Default public route from RS2000 returns HTTP 403, matching the original failure. - `platform-host-agent` denies `docker exec`, explaining run #919's `000` after #284. - Local smoke after patch: `health-http:PASS-200` for `umami`. - Regression check: `mirotalk-sfu` normal URL probe still reports `health-http:PASS-200`. ### Known constraints `tailnet-https://` is an explicit per-module probe for Tailnet-gated HTTPS services. It does not change normal HTTP probes and does not expose Umami publicly. ### Explicit out-of-scope No #260 runner-pickup fix in this PR. No DB mutation. No Forgejo restart. No exposure change. No host-agent permission expansion. ### Requested decision Merge after CI/review; then trigger `platformctl-auto-apply.yml` with `module=umami` again and verify `health-http:PASS-200` in workflow evidence. ### Merge blockers Any regression in `tests/smoke.sh`, invalid module schema, or concern that `tailnet-https://` should be represented differently in schema/docs. ## Spec sources read - `prompts/codex-260-fix-plus-umami-probe-2026-05-14.md` — Phase A/B dispatch - `decisions/0018-agentic-first-fix-root-causes.md` — governance framing - `modules/umami/module.yaml` — probe spec - `modules/umami/runbook.md` — healthcheck and exposure notes - `tests/smoke.sh` — health-http implementation - `control-plane/platformctl/transport/tailscale.py` — platform host Tailnet IP env mapping - `control-plane/platformctl/health.py` — confirms health delegates smoke checks to `tests/smoke.sh` - `/tmp/platformctl-auto-apply-919/evidence/umami.health.json` — run #919 failure evidence ## Validation - `bash -n tests/smoke.sh` — pass - `uv run --project control-plane python -m platformctl.cli validate --strict-v2 modules/umami/module.yaml` — pass - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip PLATFORMCTL_RS2000_SSH_HOST=100.110.188.20 tests/smoke.sh --json umami` — `health-http:PASS-200` - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip PLATFORMCTL_RS2000_SSH_HOST=100.110.188.20 tests/smoke.sh --json mirotalk-sfu` — `health-http:PASS-200` - `uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_smoke.py -q` — 30 passed Refs #142 Refs #260

codex added the

tier/lite

label

2026-05-14 15:53:51 +02:00

codex added 1 commit

2026-05-14 15:53:51 +02:00

fix(smoke): probe Umami through Tailnet route

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s