The health check returned 200 immediately on nginx start, before
Tailscale connected. Fly.io routed traffic to the new machine with
a cold proxy cache and no MagicDNS, causing upstream DNS timeouts.
Defer the health check by returning 503 until a sentinel file
(/tmp/tailscale-ready) is created after Tailscale connects. This
keeps the old machine serving traffic during the startup window.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>