marcel/familienarchiv
1
0
Fork 0
Code Issues 118 Pull Requests 2 Actions 4 Packages Projects Releases Wiki Activity

fix(infra): frontend healthcheck on 127.0.0.1, not localhost #525

Merged
marcel merged 1 commits from fix/frontend-healthcheck-ipv4 into main 2026-05-11 18:52:31 +02:00
Conversation 0 Commits 1 Files Changed 1 +1 -1
marcel commented 2026-05-11 18:50:23 +02:00
Owner
Copy Link

Summary

Nightly Main Deploy staging has been failing since the new alpine-based frontend production image landed (8b109349, 2026-05-10):

Container archiv-staging-frontend-1 is unhealthy

The app itself is fine. The healthcheck is broken.

Root cause

Inside node:20.19.0-alpine3.21, /etc/hosts resolves localhost only to ::1:

$ docker exec archiv-staging-frontend-1 getent hosts localhost
::1               localhost  localhost

SvelteKit's adapter-node binds to 0.0.0.0 (IPv4 only) — no IPv6 listener. So the healthcheck's wget http://localhost:3000/login connects to ::1:3000, gets Connection refused, exits 1, every 15s. After 10 retries the container is marked unhealthy and docker compose up --wait fails the deploy.

Verified on staging:

$ docker exec archiv-staging-frontend-1 wget -qO- http://127.0.0.1:3000/login >/dev/null; echo $?
0
$ docker exec archiv-staging-frontend-1 wget -qO- http://[::1]:3000/login >/dev/null 2>&1; echo $?
1

Fix

Switch the healthcheck URL to 127.0.0.1 — bypasses /etc/hosts and matches what Node actually listens on. One-character change.

Test plan

  • Merge → next nightly Main Deploy staging completes
  • After deploy: docker ps on hetzner shows archiv-staging-frontend-1 as (healthy)
  • docker inspect archiv-staging-frontend-1 --format '{{.State.Health.Status}}' returns healthy

🤖 Generated with Claude Code

## Summary Nightly `Main Deploy staging` has been failing since the new alpine-based frontend production image landed (8b109349, 2026-05-10): > Container archiv-staging-frontend-1 is unhealthy The app itself is fine. The healthcheck is broken. ## Root cause Inside `node:20.19.0-alpine3.21`, `/etc/hosts` resolves `localhost` only to `::1`: ``` $ docker exec archiv-staging-frontend-1 getent hosts localhost ::1 localhost localhost ``` SvelteKit's adapter-node binds to `0.0.0.0` (IPv4 only) — no IPv6 listener. So the healthcheck's `wget http://localhost:3000/login` connects to `::1:3000`, gets `Connection refused`, exits 1, every 15s. After 10 retries the container is marked unhealthy and `docker compose up --wait` fails the deploy. Verified on staging: ``` $ docker exec archiv-staging-frontend-1 wget -qO- http://127.0.0.1:3000/login >/dev/null; echo $? 0 $ docker exec archiv-staging-frontend-1 wget -qO- http://[::1]:3000/login >/dev/null 2>&1; echo $? 1 ``` ## Fix Switch the healthcheck URL to `127.0.0.1` — bypasses `/etc/hosts` and matches what Node actually listens on. One-character change. ## Test plan - [ ] Merge → next nightly `Main Deploy staging` completes - [ ] After deploy: `docker ps` on hetzner shows `archiv-staging-frontend-1` as `(healthy)` - [ ] `docker inspect archiv-staging-frontend-1 --format '{{.State.Health.Status}}'` returns `healthy` 🤖 Generated with [Claude Code](https://claude.com/claude-code)
marcel added 1 commit 2026-05-11 18:50:23 +02:00
fix(infra): frontend healthcheck on 127.0.0.1, not localhost
Some checks failed
CI / Unit & Component Tests (pull_request) Failing after 2m53s
Details
CI / OCR Service Tests (pull_request) Successful in 17s
Details
CI / Backend Unit Tests (pull_request) Successful in 4m33s
Details
CI / fail2ban Regex (pull_request) Successful in 40s
Details
CI / Compose Bucket Idempotency (pull_request) Successful in 1m0s
Details
CI / Unit & Component Tests (push) Failing after 2m52s
Details
CI / OCR Service Tests (push) Successful in 18s
Details
CI / Backend Unit Tests (push) Successful in 4m23s
Details
CI / fail2ban Regex (push) Successful in 39s
Details
CI / Compose Bucket Idempotency (push) Successful in 1m0s
Details
5f3529439a 
The new alpine-based frontend production image (`node:20.19.0-alpine3.21`)
resolves `localhost` only to `::1` in /etc/hosts. SvelteKit's adapter-node
binds to 0.0.0.0 (IPv4 only), so `wget http://localhost:3000/login` from
inside the container connects to ::1 and gets "Connection refused" every
15s. Container goes unhealthy → `docker compose up --wait` fails → nightly
staging deploy fails. The app itself is fine.

Switching to 127.0.0.1 bypasses /etc/hosts and matches what Node actually
listens on.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
marcel merged commit 5f3529439a into main 2026-05-11 18:52:31 +02:00
marcel deleted branch fix/frontend-healthcheck-ipv4 2026-05-11 18:52:31 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0-critical
Blocks a core user journey, causes data loss, or is a security/accessibility barrier. Work on this before P1+.
 P1-high
Significant friction on a main user journey; workaround exists but is non-obvious. Next up after P0.
 P2-medium
Noticeable improvement; doesn't block anything; schedule opportunistically.
 P3-later
Cosmetic or parking-lot work; fine to stay open indefinitely.
 audit
Read-only audit / assessment work; produces a report rather than changing code
 bug
Something isn't working
 cleanup
Removal of dead code, vague comments, naming violations, and scratch artifacts
 collaboration
We want to extend the family archive to have more collaboration tools
 conversation
descoped
We will do that later
 devops
documentation
README, ARCHITECTURE, GLOSSARY, CONTRIBUTING, per-domain docs
 epic
Marker for epic-level issues that group multiple child issues
 feature
file-upload
legibility
Codebase Legibility Refactor — preparing the codebase for human evaluation and bus-factor reduction
 notification
person
phase-1: security
Security hygiene — must be done first
 phase-2: container-images
Production-ready multi-stage Docker images
 phase-3: prod-compose
Production compose overlay + Caddy reverse proxy
 phase-4: spring-prod-profile
Spring Boot production configuration profile
 phase-5: backups
Database and object storage backup strategy
 phase-6: deployment-docs
.env.example, DEPLOYMENT.md, runbook
 phase-7: monitoring
Prometheus, Loki, Grafana, Alertmanager
 refactor
Code restructuring without behaviour change
 security
test
ui
UI/UX and accessibility issues
 user
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Jens marcel
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: marcel/familienarchiv#525
Delete Branch "fix/frontend-healthcheck-ipv4"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?