From f7d9b49555216204b4d320fa3bc8dfeeb026625e Mon Sep 17 00:00:00 2001
From: Lutz Finsterle <lutz.finsterle@t-online.de>
Date: Sun, 12 Apr 2026 14:21:26 +0200
Subject: [PATCH] health check Update and Fixes

---
 .gitea/workflows/ci.yml   | 17 ++++++++++++++++-
 docker-compose.yml        |  3 ++-
 infra/traefik/traefik.yml |  5 +++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4b21e45..355d6a6 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -3,6 +3,7 @@ name: CI/CD
 on:
   push:
   pull_request:
+  workflow_dispatch:
 
 # Registry on the local Gitea instance (HTTP — add to Docker insecure-registries if needed)
 env:
@@ -115,4 +116,18 @@ jobs:
       - name: Verify health
         run: |
           sleep 10
-          wget -qO- http://localhost:9099/health && echo " — OK"
+
+          # 1. EMS alive — direct check via internal Docker network
+          echo -n "EMS:    "
+          docker run --rm --network ems_ems-internal alpine \
+            wget -qO- http://ems:9099/health && echo " — OK"
+
+          # 2. Traefik alive — ping endpoint (no mTLS required)
+          echo -n "Traefik: "
+          docker run --rm --network host alpine \
+            wget -qO- http://127.0.0.1:8082/ping && echo " — OK"
+
+          # 3. TCP reachability of the mTLS entrypoint from LAN IP
+          echo -n "Port 9443: "
+          docker run --rm --network host alpine sh -c \
+            "nc -zw5 192.168.0.152 9443 && echo reachable || echo UNREACHABLE"
diff --git a/docker-compose.yml b/docker-compose.yml
index 52e2213..4db12a9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,8 @@ services:
     image: traefik:v3.1
     restart: unless-stopped
     ports:
-      - "9443:9443"           # HTTPS + mTLS — open on perimeter firewall
+      - "9443:9443"                  # HTTPS + mTLS — open on perimeter firewall
+      - "127.0.0.1:8082:8082"        # Traefik ping — LAN only, never expose externally
     volumes:
       - ./infra/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./infra/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
diff --git a/infra/traefik/traefik.yml b/infra/traefik/traefik.yml
index 8151001..1a4560e 100644
--- a/infra/traefik/traefik.yml
+++ b/infra/traefik/traefik.yml
@@ -5,12 +5,17 @@
 entryPoints:
   websecure:
     address: ":9443"
+  ping:
+    address: ":8082"     # internal health/ping — not exposed externally
 
 providers:
   file:
     filename: /etc/traefik/dynamic.yml
     watch: true          # reload dynamic.yml without container restart
 
+ping:
+  entryPoint: ping       # GET http://localhost:8082/ping → 200 OK when Traefik is up
+
 log:
   level: INFO