fix(modules): probe uptime-kuma through tailnet #301

Merged

pdurlej merged 1 commit from codex/f3/uptime-kuma-tailnet-health into main

2026-05-16 13:34:09 +02:00

codex commented

2026-05-16 13:32:25 +02:00

Collaborator

Canary status: local verification — strict-v2, smoke, and health tests pass; Forgejo PR checks required before merge.

Summary

Change uptime-kuma health probe from public https:// to tailnet-https://.
Keeps the expected status at 200, but resolves uptime.pdurlej.com to RS2000's tailnet address during smoke.
This matches the module exposure model: tailnet-only behind ts-allowlist@file.

Why

F3 run #977 after #300 had:

plan: in-sync, exitCode 0
apply: noop, exitCode 0
container: still healthy
health: FAIL-403-vs-expected-200

Direct public probe gets 403 as expected for a tailnet-only service. Tailnet-resolved probe returns 200 for /health.

Evidence

curl --resolve uptime.pdurlej.com:443:100.110.188.20 https://uptime.pdurlej.com/health => HTTP 200
PLATFORMCTL_SMOKE_REMOTE_MODE=skip ... tests/smoke.sh --json uptime-kuma => health-http:PASS-200
uv run --project control-plane python -m platformctl validate --strict-v2 modules/uptime-kuma/module.yaml => OK
uv run --project control-plane pytest control-plane/platformctl/tests/test_health_phase3.py => 19 passed
git diff --check => clean

Spec sources read

modules/uptime-kuma/module.yaml — failing health probe definition
modules/uptime-kuma/runbook.md — exposure and runtime context
tests/smoke.sh — tailnet-https:// health probe semantics
control-plane/platformctl/health.py — health rollup behavior

Risk

Lite. One module manifest health URL only. No runtime mutation, no compose change, no secret/exposure change. The service remains tailnet-only.

Canary status: local verification — strict-v2, smoke, and health tests pass; Forgejo PR checks required before merge. ## Summary - Change `uptime-kuma` health probe from public `https://` to `tailnet-https://`. - Keeps the expected status at 200, but resolves `uptime.pdurlej.com` to RS2000's tailnet address during smoke. - This matches the module exposure model: tailnet-only behind `ts-allowlist@file`. ## Why F3 run #977 after #300 had: - plan: `in-sync`, exitCode 0 - apply: `noop`, exitCode 0 - container: still healthy - health: `FAIL-403-vs-expected-200` Direct public probe gets 403 as expected for a tailnet-only service. Tailnet-resolved probe returns 200 for `/health`. ## Evidence - `curl --resolve uptime.pdurlej.com:443:100.110.188.20 https://uptime.pdurlej.com/health` => HTTP 200 - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip ... tests/smoke.sh --json uptime-kuma` => `health-http:PASS-200` - `uv run --project control-plane python -m platformctl validate --strict-v2 modules/uptime-kuma/module.yaml` => OK - `uv run --project control-plane pytest control-plane/platformctl/tests/test_health_phase3.py` => 19 passed - `git diff --check` => clean ## Spec sources read - `modules/uptime-kuma/module.yaml` — failing health probe definition - `modules/uptime-kuma/runbook.md` — exposure and runtime context - `tests/smoke.sh` — `tailnet-https://` health probe semantics - `control-plane/platformctl/health.py` — health rollup behavior ## Risk Lite. One module manifest health URL only. No runtime mutation, no compose change, no secret/exposure change. The service remains tailnet-only.

codex added 1 commit

2026-05-16 13:32:26 +02:00

fix(modules): probe uptime-kuma through tailnet

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 20s

Details

canary-required / canary (pull_request) Successful in 13s