fix(ci): resolve smoke test host via bridge gateway, not 127.0.0.1

Job containers run in bridge network mode (runner-config.yaml). Inside
a bridge-networked container 127.0.0.1 is the container's own loopback;
Caddy on the host is unreachable there, causing an immediate ECONNREFUSED.

Use the Docker bridge gateway IP instead — the host's docker0 interface
where Caddy (bound on 0.0.0.0:443) is reachable from the container.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -135,16 +135,20 @@ jobs:
         # public surface works. This step catches: Caddy not reloaded, HSTS
         # header dropped, /actuator block bypassed.
         #
-        # --resolve pins staging.raddatz.cloud to the runner's loopback so we
+        # --resolve pins staging.raddatz.cloud to the Docker bridge gateway IP
-        # do NOT depend on the host router doing hairpin NAT (many SOHO
+        # (the host) so we do NOT depend on hairpin NAT on the host router.
-        # routers do not, or do so only after a firmware update). SNI still
+        # 127.0.0.1 cannot be used: job containers run in bridge network mode
-        # uses the public hostname so the cert validates correctly.
+        # (runner-config.yaml), so 127.0.0.1 is the container's loopback, not
+        # the host's. The bridge gateway IS the host; Caddy binds 0.0.0.0:443
+        # and is therefore reachable from the container via that IP.
+        # SNI still uses the public hostname so the TLS cert validates correctly.
         run: |
           set -e
           HOST="staging.raddatz.cloud"
           URL="https://$HOST"
-          RESOLVE="--resolve $HOST:443:127.0.0.1"
+          HOST_IP=$(ip route show default | awk '/default/ {print $3}')
-          echo "Smoke test: $URL (pinned to 127.0.0.1)"
+          RESOLVE="--resolve $HOST:443:$HOST_IP"
+          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
           curl -fsS $RESOLVE --max-time 10 "$URL/login" -o /dev/null
           # Pin the preload-list-eligible HSTS value, not just header presence:
           # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must

.gitea/workflows/release.yml

@@ -106,14 +106,15 @@ jobs:
 
       - name: Smoke test deployed environment
         # See nightly.yml — same three checks, against the prod vhost.
-        # --resolve pins archiv.raddatz.cloud to the runner's loopback so
+        # --resolve pins to the bridge gateway IP (the host), not 127.0.0.1
-        # the smoke test does NOT depend on hairpin NAT on the host router.
+        # — see nightly.yml for the full network topology explanation.
         run: |
           set -e
           HOST="archiv.raddatz.cloud"
           URL="https://$HOST"
-          RESOLVE="--resolve $HOST:443:127.0.0.1"
+          HOST_IP=$(ip route show default | awk '/default/ {print $3}')
-          echo "Smoke test: $URL (pinned to 127.0.0.1)"
+          RESOLVE="--resolve $HOST:443:$HOST_IP"
+          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
           curl -fsS $RESOLVE --max-time 10 "$URL/login" -o /dev/null
           # Pin the preload-list-eligible HSTS value, not just header presence:
           # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must