health check Update and Fixes

.gitea/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI/CD
 on:
   push:
   pull_request:
+  workflow_dispatch:
 
 # Registry on the local Gitea instance (HTTP — add to Docker insecure-registries if needed)
 env:
@@ -115,4 +116,18 @@ jobs:
       - name: Verify health
         run: |
           sleep 10
-          wget -qO- http://localhost:9099/health && echo " — OK"
+
+          # 1. EMS alive — direct check via internal Docker network
+          echo -n "EMS:    "
+          docker run --rm --network ems_ems-internal alpine \
+            wget -qO- http://ems:9099/health && echo " — OK"
+
+          # 2. Traefik alive — ping endpoint (no mTLS required)
+          echo -n "Traefik: "
+          docker run --rm --network host alpine \
+            wget -qO- http://127.0.0.1:8082/ping && echo " — OK"
+
+          # 3. TCP reachability of the mTLS entrypoint from LAN IP
+          echo -n "Port 9443: "
+          docker run --rm --network host alpine sh -c \
+            "nc -zw5 192.168.0.152 9443 && echo reachable || echo UNREACHABLE"

docker-compose.yml

@@ -12,7 +12,8 @@ services:
     image: traefik:v3.1
     restart: unless-stopped
     ports:
-      - "9443:9443"           # HTTPS + mTLS — open on perimeter firewall
+      - "9443:9443"                  # HTTPS + mTLS — open on perimeter firewall
+      - "127.0.0.1:8082:8082"        # Traefik ping — LAN only, never expose externally
     volumes:
       - ./infra/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./infra/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro

infra/traefik/traefik.yml

@@ -5,12 +5,17 @@
 entryPoints:
   websecure:
     address: ":9443"
+  ping:
+    address: ":8082"     # internal health/ping — not exposed externally
 
 providers:
   file:
     filename: /etc/traefik/dynamic.yml
     watch: true          # reload dynamic.yml without container restart
 
+ping:
+  entryPoint: ping       # GET http://localhost:8082/ping → 200 OK when Traefik is up
+
 log:
   level: INFO