Fix BRouter first-deploy issues discovered during cutover

Three fixes after the first cd-brouter run on the dedicated host:

1. **BRouter 1.7.8 → 1.7.9** (`docker/brouter/Dockerfile`). Planet RD5
   segments on brouter.de are now version 11; 1.7.8's `lookups.dat`
   is v10, causing `lookup version mismatch (old rd5?)
   lookups.dat=10 E10_N45.rd5=11` on every route request.

2. **cd-brouter.yml: docker login to ghcr.io before pull**.
   ghcr.io/trails-cool/brouter is private, and the dedicated host's
   Docker daemon isn't logged in by default. Extract DEPLOY_GHCR_TOKEN
   from SOPS at runner side, pass to the SSH step via envs, and
   `docker login` before `docker compose pull`. Credential is
   `::add-mask::`-ed so it doesn't show in logs.

3. **Drop custom healthcheck** on the brouter service. The image
   strips wget/curl post-build, and /bin/sh in the base doesn't
   support /dev/tcp, so there's no in-image way to do an HTTP probe.
   Real health is observed via Caddy's upstream 502 behavior on
   outage and the Planner-side `brouter_request_duration_seconds`
   metric. caddy's `depends_on` drops from service_healthy to
   service_started.

End-to-end verified on the dedicated host after applying the compose
fix manually:
- Caddy enforces auth: 403 without header, proxies with.
- BRouter 1.7.9 will resolve the segment-version error once the image
  is rebuilt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/cd-brouter.yml

@@ -45,6 +45,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Decrypt shared secret
+        id: decrypt
         run: |
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
@@ -55,6 +56,14 @@ jobs:
             | grep '^BROUTER_AUTH_TOKEN=' > infrastructure/brouter-host/.env
           chmod 0600 infrastructure/brouter-host/.env
 
+          # GHCR pull credential — not shipped to the host's filesystem;
+          # passed to the SSH step as an env var so it only lives in
+          # memory during `docker login`.
+          GHCR_TOKEN=$(SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env \
+            | grep '^DEPLOY_GHCR_TOKEN=' | cut -d= -f2-)
+          echo "::add-mask::$GHCR_TOKEN"
+          echo "GHCR_TOKEN=$GHCR_TOKEN" >> $GITHUB_ENV
+
       - name: Copy compose project to dedicated host
         uses: appleboy/scp-action@v1
         with:
@@ -73,6 +82,7 @@ jobs:
           username: trails
           port: ${{ secrets.BROUTER_DEPLOY_SSH_PORT }}
           key: ${{ secrets.BROUTER_DEPLOY_SSH_KEY }}
+          envs: GHCR_TOKEN
           script: |
             set -euo pipefail
             cd /home/trails/brouter
@@ -89,6 +99,11 @@ jobs:
               mkdir -p segments
             fi
 
+            # GHCR images (brouter) are private; log in so pull works.
+            # Credentials stay in ~/.docker/config.json; acceptable on a
+            # single-tenant trails user.
+            echo "$GHCR_TOKEN" | docker login ghcr.io -u stigi --password-stdin
+
             docker compose pull
             docker compose up -d --remove-orphans
             docker compose ps

docker/brouter/Dockerfile

@@ -3,7 +3,7 @@ FROM eclipse-temurin:11-jre-jammy
 WORKDIR /brouter
 
 # Download latest BRouter release
-ARG BROUTER_VERSION=1.7.8
+ARG BROUTER_VERSION=1.7.9
 RUN apt-get update && apt-get install -y --no-install-recommends wget unzip curl \
     && wget -q "https://github.com/abrensch/brouter/releases/download/v${BROUTER_VERSION}/brouter-${BROUTER_VERSION}.zip" \
     && unzip "brouter-${BROUTER_VERSION}.zip" \

infrastructure/brouter-host/docker-compose.yml

@@ -33,12 +33,10 @@ services:
         max-file: "3"
     labels:
       trails.cool.service: "brouter"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O- http://localhost:17777/ >/dev/null 2>&1 || exit 1"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 60s
+    # No custom healthcheck: the BRouter image strips wget/curl post-build,
+    # and /bin/sh in the base image doesn't support /dev/tcp. Real health
+    # is observed via Caddy upstream (502 on outage) and the Planner-side
+    # brouter_request_duration_seconds metric.
 
   caddy:
     image: caddy:2-alpine
@@ -46,7 +44,7 @@ services:
     restart: unless-stopped
     depends_on:
       brouter:
-        condition: service_healthy
+        condition: service_started
     # Bind ONLY to the vSwitch IP on the host — the dedicated host's
     # public IP remains unaffected. UFW further restricts this to traffic
     # sourced from the flagship's private IP (10.0.0.2).