chore(docker): add HEALTHCHECK to outline-sync-ts sidecar

wget --spider on 127.0.0.1:8080 verifies the Tailscale
sidecar's network namespace is forwarding to the UI
backend (UI shares the ts container's network ns).
start_period=60s covers Tailscale auth + tailscaled boot.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -5,15 +5,9 @@ on:
     branches:
       - main
   workflow_dispatch:
-    inputs:
-      reason:
-        description: "Reason for manual deploy"
-        required: false
-        default: "manual"
 
 env:
-  COMPOSE_PROJECT: outline-sync
-  COMPOSE_FILE: docker-compose.yml
+  IMAGE: git.domverse-berlin.eu/ci/outline-sync/ui
 
 jobs:
   deploy:
@@ -21,45 +15,26 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
 
-      - name: Bump patch version
-        if: github.event_name != 'workflow_dispatch'
-        run: |
-          VERSION=$(cat VERSION)
-          MAJOR=$(echo $VERSION | cut -d. -f1)
-          MINOR=$(echo $VERSION | cut -d. -f2)
-          PATCH=$(echo $VERSION | cut -d. -f3)
-          NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
-          echo $NEW_VERSION > VERSION
-          echo "APP_VERSION=$NEW_VERSION" >> $GITHUB_ENV
-          git config user.email "ci@domverse-berlin.eu"
-          git config user.name "CI"
-          git add VERSION
-          git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
-          git push
+      - name: Login to Gitea registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.domverse-berlin.eu -u ci --password-stdin
 
-      - name: Write .env
+      - name: Build and push
         run: |
-          cat > .env << EOF
-          OUTLINE_URL=http://outline:3000
-          OUTLINE_TOKEN=${{ secrets.OUTLINE_TOKEN }}
-          LOCAL_OUTLINE_URL=${{ secrets.LOCAL_OUTLINE_URL }}
-          LOCAL_OUTLINE_TOKEN=${{ secrets.LOCAL_OUTLINE_TOKEN }}
-          LOCAL_OUTLINE_HOST=${{ secrets.LOCAL_OUTLINE_HOST }}
-          TS_AUTHKEY=${{ secrets.TS_AUTHKEY }}
-          EOF
+          docker build --build-arg APP_VERSION="${{ gitea.sha }}" \
+            -t "$IMAGE:latest" -t "$IMAGE:${{ gitea.sha }}" .
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:${{ gitea.sha }}"
 
-      - name: Deploy with docker compose
+      - name: Trigger Portainer redeploy (retry on transient pull-lease failure)
         run: |
-          APP_VERSION=${APP_VERSION:-$(cat VERSION)}
-          echo "=== Deploying $APP_VERSION (commit ${{ gitea.sha }}) to ${{ gitea.ref_name }} ==="
-          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" build --build-arg APP_VERSION=$APP_VERSION
-          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up -d --remove-orphans
+          for i in 1 2 3; do
+            code=$(curl -sk -X POST -o /dev/null -w '%{http_code}' "${{ secrets.PORTAINER_WEBHOOK_URL }}")
+            echo "attempt $i -> $code"
+            [ "$code" = "204" ] && exit 0
+            sleep 5
+          done
+          exit 1
 
       - name: Prune dangling images
         run: docker image prune -f
-
-      - name: Show running containers
-        run: docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" ps

Dockerfile

@@ -35,5 +35,8 @@ RUN git init /vault && \
 
 EXPOSE 8080
 
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=30s \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/').close()" || exit 1
+
 ENTRYPOINT ["/work/entrypoint.sh"]
 CMD ["uvicorn", "webui:app", "--host", "0.0.0.0", "--port", "8080"]

docker-compose.yml

@@ -20,6 +20,12 @@ services:
     extra_hosts:
       - "outline:100.104.53.109"
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:8080/ || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
     networks:
       - default
       - domverse
@@ -29,14 +35,11 @@ services:
       - "traefik.http.routers.outline-sync.rule=Host(`sync.domverse-berlin.eu`)"
       - "traefik.http.routers.outline-sync.entrypoints=https"
       - "traefik.http.routers.outline-sync.tls.certresolver=http"
-      - "traefik.http.routers.outline-sync.middlewares=authentik@docker"
+      - "traefik.http.routers.outline-sync.middlewares=crowdsec@file,authentik@docker"
       - "traefik.http.services.outline-sync.loadbalancer.server.port=8080"
 
   outline-sync-ui:
-    build:
-      context: .
-      args:
-        APP_VERSION: ${APP_VERSION:-dev}
+    image: git.domverse-berlin.eu/ci/outline-sync/ui:${TAG:-latest}
     container_name: outline-sync-ui
     restart: unless-stopped
     depends_on: