3c4c1eebd8
Three fixes after the first cd-brouter run on the dedicated host: 1. **BRouter 1.7.8 → 1.7.9** (`docker/brouter/Dockerfile`). Planet RD5 segments on brouter.de are now version 11; 1.7.8's `lookups.dat` is v10, causing `lookup version mismatch (old rd5?) lookups.dat=10 E10_N45.rd5=11` on every route request. 2. **cd-brouter.yml: docker login to ghcr.io before pull**. ghcr.io/trails-cool/brouter is private, and the dedicated host's Docker daemon isn't logged in by default. Extract DEPLOY_GHCR_TOKEN from SOPS at runner side, pass to the SSH step via envs, and `docker login` before `docker compose pull`. Credential is `::add-mask::`-ed so it doesn't show in logs. 3. **Drop custom healthcheck** on the brouter service. The image strips wget/curl post-build, and /bin/sh in the base doesn't support /dev/tcp, so there's no in-image way to do an HTTP probe. Real health is observed via Caddy's upstream 502 behavior on outage and the Planner-side `brouter_request_duration_seconds` metric. caddy's `depends_on` drops from service_healthy to service_started. End-to-end verified on the dedicated host after applying the compose fix manually: - Caddy enforces auth: 403 without header, proxies with. - BRouter 1.7.9 will resolve the segment-version error once the image is rebuilt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| brouter-host | ||
| grafana | ||
| loki | ||
| postgres | ||
| prometheus | ||
| promtail | ||
| scripts | ||
| terraform | ||
| .env.example | ||
| Caddyfile | ||
| docker-compose.yml | ||
| secrets.app.env | ||
| secrets.infra.env | ||