From adea0f457d8ca7d390df6edfefe92bdf217552aa Mon Sep 17 00:00:00 2001 From: The_miro Date: Thu, 2 Jul 2026 13:22:24 +0200 Subject: [PATCH] fix(ansipa): reliable nginx + keycloak healthchecks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both containers were reporting "unhealthy" while serving fine — the healthchecks I added probed the wrong address/endpoint: - nginx: `wget localhost` resolves to IPv6 ::1 inside the container, but nginx listens on IPv4 0.0.0.0:80 only, so the probe was refused. Use 127.0.0.1. - keycloak: with KC_HTTP_RELATIVE_PATH=/auth, /health/ready on the 9000 management port returns 404. Probe /auth/realms/master on the serving port 8080 instead (bash /dev/tcp — the image has no curl/wget). Verified all five containers report healthy and the gateway serves /, /ipa/ui/, /cmk/ and /auth/ correctly. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi --- .../FreeipaAnsible/image/docker-compose.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/setup/modules/FreeipaAnsible/image/docker-compose.yml b/setup/modules/FreeipaAnsible/image/docker-compose.yml index 1964440..008e306 100644 --- a/setup/modules/FreeipaAnsible/image/docker-compose.yml +++ b/setup/modules/FreeipaAnsible/image/docker-compose.yml @@ -233,11 +233,12 @@ services: networks: ipa-net: healthcheck: - # The official Keycloak image ships neither curl nor wget, and since - # KC 25 the health endpoints live on the management port (9000) and are - # only served when KC_HEALTH_ENABLED=true. Use bash's /dev/tcp instead - # of curl so the check works inside the stock image. - test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"] + # The official Keycloak image ships neither curl nor wget (but has bash), + # so probe with bash's /dev/tcp. Check the actual serving port under the + # configured relative path (/auth) rather than the 9000 management + # /health endpoint — with KC_HTTP_RELATIVE_PATH set, /health/ready on 9000 + # returns 404, whereas /auth/realms/master reliably returns 200 once up. + test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /auth/realms/master HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -c 15 <&3 | grep -q '200 OK'"] interval: 20s timeout: 10s retries: 20 @@ -276,7 +277,10 @@ services: networks: ipa-net: healthcheck: - test: ["CMD-SHELL", "wget -qO- http://localhost/ >/dev/null 2>&1 || exit 1"] + # Use 127.0.0.1, not localhost: inside the container localhost resolves to + # IPv6 ::1, but nginx listens on IPv4 0.0.0.0:80 only, so a localhost probe + # is refused even though the gateway is serving fine. + test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"] interval: 30s timeout: 10s retries: 10