fix(modules): probe Meerkat and ntfy health through Tailnet #307

Merged

pdurlej merged 1 commit from codex/f3/tailnet-health-batch into main

2026-05-17 01:12:47 +02:00

codex commented

2026-05-17 01:07:23 +02:00

Collaborator

Canary status: missing — F3 health-probe batch; PR checks required before merge.

Canary Context Pack

Product story

Continue the operator-approved F3 stateful no-op batch without repeatedly stopping on known Tailnet-gated health endpoints.

What changed

Changed np-meerkat-backend and ntfy health probes from direct public HTTPS to tailnet-https:// while keeping expected status 200.

Why it changed

F3 run #1041 for np-meerkat-backend proved plan/apply were no-op and container health was good, but public health returned 403. Live checks show both meerkat.pdurlej.com/health and ntfy.pdurlej.com/health return 200 when resolved through RS2000 Tailnet, and 403 on ordinary public probe.

Files touched

modules/np-meerkat-backend/module.yaml
modules/ntfy/module.yaml

Runtime evidence

curl https://meerkat.pdurlej.com/health -> 403; curl --resolve meerkat.pdurlej.com:443:100.110.188.20 https://meerkat.pdurlej.com/health -> 200
curl https://ntfy.pdurlej.com/health -> 403; curl --resolve ntfy.pdurlej.com:443:100.110.188.20 https://ntfy.pdurlej.com/health -> 200
np-meerkat-backend run #1041: plan in-sync, apply noop, container running healthy, health failed only on HTTP 403.

Known constraints

No runtime mutation in this PR. safe-session-api already has no HTTP probe and remains container-only.

Explicit out-of-scope

No compose changes, no production restart, no deploy-control backup-profile fix.

Requested decision

Merge to retry np-meerkat-backend and continue with ntfy + safe-session-api.

Merge blockers

PR checks red or Tailnet probe contract unsupported.

Spec sources read

modules/np-meerkat-backend/module.yaml
modules/ntfy/module.yaml
modules/safe-session-api/module.yaml
tests/smoke.sh tailnet-https:// handling
F3 run #1041 artifact summary

Verification

uv run --with click --with jsonschema --with PyYAML --with httpx python -m platformctl.cli validate --strict-v2 ../modules/np-meerkat-backend/module.yaml: green
uv run --with click --with jsonschema --with PyYAML --with httpx python -m platformctl.cli validate --strict-v2 ../modules/ntfy/module.yaml: green
uv run --with pytest --with click --with jsonschema --with PyYAML --with httpx python -m pytest platformctl/tests/test_health_phase3.py: 19 passed

Canary status: missing — F3 health-probe batch; PR checks required before merge. ## Canary Context Pack ### Product story Continue the operator-approved F3 stateful no-op batch without repeatedly stopping on known Tailnet-gated health endpoints. ### What changed Changed `np-meerkat-backend` and `ntfy` health probes from direct public HTTPS to `tailnet-https://` while keeping expected status `200`. ### Why it changed F3 run #1041 for `np-meerkat-backend` proved plan/apply were no-op and container health was good, but public health returned `403`. Live checks show both `meerkat.pdurlej.com/health` and `ntfy.pdurlej.com/health` return `200` when resolved through RS2000 Tailnet, and `403` on ordinary public probe. ### Files touched - `modules/np-meerkat-backend/module.yaml` - `modules/ntfy/module.yaml` ### Runtime evidence - `curl https://meerkat.pdurlej.com/health` -> 403; `curl --resolve meerkat.pdurlej.com:443:100.110.188.20 https://meerkat.pdurlej.com/health` -> 200 - `curl https://ntfy.pdurlej.com/health` -> 403; `curl --resolve ntfy.pdurlej.com:443:100.110.188.20 https://ntfy.pdurlej.com/health` -> 200 - `np-meerkat-backend` run #1041: plan `in-sync`, apply `noop`, container running healthy, health failed only on HTTP 403. ### Known constraints No runtime mutation in this PR. `safe-session-api` already has no HTTP probe and remains container-only. ### Explicit out-of-scope No compose changes, no production restart, no `deploy-control` backup-profile fix. ### Requested decision Merge to retry `np-meerkat-backend` and continue with `ntfy` + `safe-session-api`. ### Merge blockers PR checks red or Tailnet probe contract unsupported. ## Spec sources read - `modules/np-meerkat-backend/module.yaml` - `modules/ntfy/module.yaml` - `modules/safe-session-api/module.yaml` - `tests/smoke.sh` `tailnet-https://` handling - F3 run #1041 artifact summary ## Verification - `uv run --with click --with jsonschema --with PyYAML --with httpx python -m platformctl.cli validate --strict-v2 ../modules/np-meerkat-backend/module.yaml`: green - `uv run --with click --with jsonschema --with PyYAML --with httpx python -m platformctl.cli validate --strict-v2 ../modules/ntfy/module.yaml`: green - `uv run --with pytest --with click --with jsonschema --with PyYAML --with httpx python -m pytest platformctl/tests/test_health_phase3.py`: 19 passed

codex added 1 commit

2026-05-17 01:07:23 +02:00

fix(modules): probe Meerkat and ntfy health through Tailnet

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 20s

Details

canary-required / canary (pull_request) Successful in 13s