From 77f85832c90ffffbefb399c0d74e3d0138637bee Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Fri, 6 Nov 2026 09:07:49 +0300
Subject: [PATCH] fix(docker): the health check covers the worker and the
 console services

The container's health check only fetched the login page, through nginx
and gunicorn. A job worker, novncd or socketiod that kept failing (runit
starts it again each second) left the container healthy while jobs
waited and consoles failed. The check now also asks runit for each
service and fails when one is down or has run for less than five
seconds.
---
 Dockerfile             |  8 +++++---
 conf/runit/healthcheck | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)
 create mode 100755 conf/runit/healthcheck

diff --git a/Dockerfile b/Dockerfile
index be46843d..42e6c814 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -78,6 +78,7 @@ COPY conf/runit/socketiod.sh		/etc/service/socketiod/run
 COPY conf/runit/webvirtcloud.sh		/etc/service/webvirtcloud/run
 COPY conf/runit/webvirtcloud-worker.sh	/etc/service/webvirtcloud-worker/run
 COPY --chmod=644 conf/runit/backup.cron	/etc/cron.d/webvirtcloud-backup
+COPY --chmod=755 conf/runit/healthcheck	/usr/local/bin/webvirtcloud-healthcheck
 RUN chmod +x /etc/my_init.d/10_webvirtcloud_init.sh \
 	/etc/service/nginx/run \
 	/etc/service/nginx-log-forwarder/run \
@@ -86,10 +87,11 @@ RUN chmod +x /etc/my_init.d/10_webvirtcloud_init.sh \
 	/etc/service/webvirtcloud/run \
 	/etc/service/webvirtcloud-worker/run
 
-# X-Forwarded-Proto: https keeps the probe from being redirected when the
-# HTTPS profile is on (nginx passes the header on; see conf/nginx).
+# The panel's page and every service (conf/runit/healthcheck). X-Forwarded-Proto:
+# https keeps the probe from being redirected when the HTTPS profile is on
+# (nginx passes the header on; see conf/nginx).
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
-	CMD /srv/webvirtcloud/venv/bin/python3 -c "import urllib.request as u; u.urlopen(u.Request('http://127.0.0.1/accounts/login/', headers={'X-Forwarded-Proto': 'https'}), timeout=5)"
+	CMD /usr/local/bin/webvirtcloud-healthcheck
 
 # Declare mountable data directory for persistent SQLite and SSH keys, and the backups of both
 VOLUME ["/srv/webvirtcloud/data", "/var/www/.ssh", "/srv/webvirtcloud/backups"]
diff --git a/conf/runit/healthcheck b/conf/runit/healthcheck
new file mode 100755
index 00000000..0d9ef274
--- /dev/null
+++ b/conf/runit/healthcheck
@@ -0,0 +1,14 @@
+#!/bin/sh
+# Docker's health check: the panel answers through nginx, and every service
+# has run for a few seconds. runit starts a failing service again each
+# second, so one that keeps failing (the worker, novncd, socketiod) is never
+# up that long.
+/srv/webvirtcloud/venv/bin/python3 -c "import urllib.request as u; u.urlopen(u.Request('http://127.0.0.1/accounts/login/', headers={'X-Forwarded-Proto': 'https'}), timeout=5)" || exit 1
+for service in nginx webvirtcloud webvirtcloud-worker novnc socketiod; do
+    # "run: /etc/service/novnc: (pid 60) 45556s"
+    uptime=$(sv status "/etc/service/$service" | sed -n 's/^run: [^)]*) \([0-9]*\)s.*/\1/p')
+    if [ -z "$uptime" ] || [ "$uptime" -lt 5 ]; then
+        echo "$service is not running steadily: $(sv status "/etc/service/$service")"
+        exit 1
+    fi
+done