Erich Blume
bd61da4f85
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 1m20s
## Summary - Health check (`/healthz`) now returns 503 until Tailscale is connected - `start.sh` creates `/tmp/tailscale-ready` sentinel after `tailscale up` succeeds - Fly.io keeps the old machine serving traffic during the ~7s startup window Previously, nginx passed the health check immediately, Fly.io routed traffic to the new machine, but MagicDNS wasn't available yet — causing upstream DNS timeouts and 502s on every request until Tailscale connected. ## Deployment and Testing - [ ] Merge and `fly deploy` from `fly/` directory - [ ] Verify deploy completes with zero 502s (check Grafana docs-apm dashboard) - [ ] Confirm health check transitions from 503 → 200 in `fly logs` Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/131
31 lines
1.1 KiB
Bash
31 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Start nginx immediately so port 8080 is bound (avoids connection refused).
|
|
# Health check returns 503 until /tmp/tailscale-ready exists, so Fly.io
|
|
# keeps the old machine serving traffic until Tailscale connects.
|
|
nginx -g "daemon off;" &
|
|
NGINX_PID=$!
|
|
echo "Nginx started (waiting for Tailscale before proxying)"
|
|
|
|
# Start tailscale daemon. Fly.io runs Firecracker microVMs which support
|
|
# TUN devices natively — no need for --tun=userspace-networking.
|
|
tailscaled --statedir=/var/lib/tailscale &
|
|
sleep 2
|
|
|
|
# Authenticate and join tailnet
|
|
tailscale up --authkey="${TS_AUTHKEY}" --hostname=flyio-proxy
|
|
|
|
# Wait for tailscale to be ready, then signal nginx health check
|
|
until tailscale status > /dev/null 2>&1; do sleep 1; done
|
|
touch /tmp/tailscale-ready
|
|
echo "Tailscale connected"
|
|
|
|
# Start Alloy for observability (logs → Loki, metrics → Prometheus)
|
|
alloy run /etc/alloy/config.alloy \
|
|
--server.http.listen-addr=127.0.0.1:12345 \
|
|
--storage.path=/tmp/alloy-data &
|
|
echo "Alloy started"
|
|
|
|
# Block on nginx — container exits if nginx stops
|
|
wait $NGINX_PID
|