The_miro
/
Dotfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(ansipa): reliable nginx + keycloak healthchecks 

Both containers were reporting "unhealthy" while serving fine — the
healthchecks I added probed the wrong address/endpoint:

- nginx: `wget localhost` resolves to IPv6 ::1 inside the container, but nginx
  listens on IPv4 0.0.0.0:80 only, so the probe was refused. Use 127.0.0.1.
- keycloak: with KC_HTTP_RELATIVE_PATH=/auth, /health/ready on the 9000
  management port returns 404. Probe /auth/realms/master on the serving port
  8080 instead (bash /dev/tcp — the image has no curl/wget).

Verified all five containers report healthy and the gateway serves /, /ipa/ui/,
/cmk/ and /auth/ correctly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
feat/astal-menu
Amir Alexander Abdelbaki 2026-07-02 13:22:24 +02:00
parent 435547822c
commit adea0f457d
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
setup/modules/FreeipaAnsible/image/docker-compose.yml
View File

@ -233,11 +233,12 @@ services:
networks: networks:
ipa-net: ipa-net:
healthcheck: healthcheck:
# The official Keycloak image ships neither curl nor wget, and since # The official Keycloak image ships neither curl nor wget (but has bash),
# KC 25 the health endpoints live on the management port (9000) and are # so probe with bash's /dev/tcp. Check the actual serving port under the
# only served when KC_HEALTH_ENABLED=true. Use bash's /dev/tcp instead # configured relative path (/auth) rather than the 9000 management
# of curl so the check works inside the stock image. # /health endpoint — with KC_HTTP_RELATIVE_PATH set, /health/ready on 9000
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"] # returns 404, whereas /auth/realms/master reliably returns 200 once up.
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /auth/realms/master HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -c 15 <&3 | grep -q '200 OK'"]
interval: 20s interval: 20s
timeout: 10s timeout: 10s
retries: 20 retries: 20
@ -276,7 +277,10 @@ services:
networks: networks:
ipa-net: ipa-net:
healthcheck: healthcheck:
test: ["CMD-SHELL", "wget -qO- http://localhost/ >/dev/null 2>&1 || exit 1"] # Use 127.0.0.1, not localhost: inside the container localhost resolves to
# IPv6 ::1, but nginx listens on IPv4 0.0.0.0:80 only, so a localhost probe
# is refused even though the gateway is serving fine.
test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
interval: 30s interval: 30s
timeout: 10s timeout: 10s
retries: 10 retries: 10