vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(phasefinal-web): healthcheck targeted ::1, so traefik skipped the container

Browse Source 
The healthcheck used http://localhost/, which resolves to ::1 in nginx:alpine
while nginx listens on IPv4 only — so it never passed, the container stayed
unhealthy, and Traefik silently declined to create a router for it. That
presents as a broken docker provider: correct labels, right network, no route,
no error. Target 127.0.0.1 explicitly and add a start_period.

Adds the apex router (301 phasefinal.com -> www) and drops the file-provider
workaround, which was mitigating the wrong diagnosis.
This commit is contained in:
vh
2026-08-29 22:33:21 -07:00
parent 7ffbee6f09
commit 524aa4d860
3 changed files with 28 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/phasefinal-web/README.md
+13 -7
View File
@@ -21,14 +21,20 @@ requests rule. Both must be undone on import:
Without these the page silently falls back to system fonts and looks wrong
rather than broken, which is the failure mode you won't notice.
## Routing
## Routing — and the healthcheck trap that looks like a routing bug
`conf/traefik-dynamic-phasefinal-web.yml` deploys to
**`/opt/docker/conf/traefik-ana/config/phasefinal-web.yml`** — not into this
stack's own conf dir. It exists because Traefik's docker provider on ana-docker
was not registering newly-created containers on 2026-08-29; the compose file
still carries the correct `traefik.*` labels, so once that is fixed the file
router can be deleted. See the header comment in that file.
Routers come from the compose labels: `phasefinal-web` serves
`www.phasefinal.com`; `phasefinal-apex` 301s `phasefinal.com` to it.
⚠ **Traefik silently skips containers Docker reports as unhealthy.** There is no
error, no log line, and no router — it looks exactly like a broken provider. The
first deploy of this stack hit that: the healthcheck used
`http://localhost/`, which resolves to `::1` in `nginx:alpine`, and nginx listens
on IPv4 only, so the check got "Connection refused" forever and the container
never left `unhealthy`. **Use `127.0.0.1`, never `localhost`, in a healthcheck
for an IPv4-only listener** — and if a correctly-labelled container never appears
in `/api/http/routers`, check `docker inspect --format '{{.State.Health.Status}}'`
*before* suspecting Traefik.
## Deploy