fix(f3): probe infisical health over tailnet #313

Merged

pdurlej merged 1 commit from codex/f3/infisical-health-probe into main

2026-05-17 02:34:39 +02:00

codex commented

2026-05-17 02:33:34 +02:00

Collaborator

Canary status: missing — module manifest health-probe fix; rely on required Forgejo checks before merge

Canary Context Pack

Product story

F3 stateful smoke for Infisical should test the actual reachable health surface. The current manifest checks a public URL that returns 403 from outside the Tailnet, while Infisical is healthy and available through the Tailnet allowlist.

What changed

Updated infisical HTTP health probe from public /health to tailnet-https://infisical.pdurlej.com/api/status.
Updated the acceptance criterion to match the Tailnet health endpoint.

Why it changed

F3 run #1089 failed after backup because https://infisical.pdurlej.com/health returns 403 through the public path. Runtime evidence shows Tailnet-resolved /api/status returns HTTP 200 and the container healthcheck is green.

Files touched

modules/infisical/module.yaml

Runtime evidence

home-platform-infisical-1 is running healthy.
Public https://infisical.pdurlej.com/health returns HTTP 403.
Tailnet-resolved https://infisical.pdurlej.com/api/status returns HTTP 200.
Container-local http://127.0.0.1:8080/api/status returns Ok with Redis configured.

Known constraints

This is probe metadata only. It does not change Infisical runtime, routing, secrets, or exposure policy.

Explicit out-of-scope

No compose changes.
No Infisical restart.
No secret reads.

Requested decision

Merge so the already-backed-up Infisical F3 smoke can be retried with the correct health probe.

Merge blockers

strict-v2 validation failure
health probe contract regression

Spec sources read

modules/infisical/module.yaml — target manifest
modules/honcho-api/module.yaml — Tailnet health URL pattern
compose/apps/compose.yaml — Infisical Traefik middleware and container healthcheck

Verification

control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/infisical/module.yaml
control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q
git diff --check

Refs: #142

Canary status: missing — module manifest health-probe fix; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story F3 stateful smoke for Infisical should test the actual reachable health surface. The current manifest checks a public URL that returns 403 from outside the Tailnet, while Infisical is healthy and available through the Tailnet allowlist. ### What changed - Updated `infisical` HTTP health probe from public `/health` to `tailnet-https://infisical.pdurlej.com/api/status`. - Updated the acceptance criterion to match the Tailnet health endpoint. ### Why it changed F3 run #1089 failed after backup because `https://infisical.pdurlej.com/health` returns 403 through the public path. Runtime evidence shows Tailnet-resolved `/api/status` returns HTTP 200 and the container healthcheck is green. ### Files touched - `modules/infisical/module.yaml` ### Runtime evidence - `home-platform-infisical-1` is `running healthy`. - Public `https://infisical.pdurlej.com/health` returns HTTP 403. - Tailnet-resolved `https://infisical.pdurlej.com/api/status` returns HTTP 200. - Container-local `http://127.0.0.1:8080/api/status` returns `Ok` with Redis configured. ### Known constraints This is probe metadata only. It does not change Infisical runtime, routing, secrets, or exposure policy. ### Explicit out-of-scope - No compose changes. - No Infisical restart. - No secret reads. ### Requested decision Merge so the already-backed-up Infisical F3 smoke can be retried with the correct health probe. ### Merge blockers - strict-v2 validation failure - health probe contract regression ## Spec sources read - `modules/infisical/module.yaml` — target manifest - `modules/honcho-api/module.yaml` — Tailnet health URL pattern - `compose/apps/compose.yaml` — Infisical Traefik middleware and container healthcheck ## Verification ```bash control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/infisical/module.yaml control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q git diff --check ``` Refs: #142

codex added 1 commit

2026-05-17 02:33:34 +02:00

fix(f3): probe infisical health over tailnet

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 18s

Details

canary-required / canary (pull_request) Successful in 13s