fix: verify deployment health in Docker host network

.gitea/workflows/rebuild.yml

@@ -21,6 +21,10 @@ jobs:
           bash scripts/deploy-unraid.sh
       - name: Verify authenticated deployment
         run: |
-          curl -sf http://127.0.0.1:8092/health -o /dev/null
+          # CI runner loopback is not the Docker host's loopback.
-          curl -sfk https://127.0.0.1:9178/ -o /dev/null
+          host_curl() {
-          test "$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
+            docker run --rm --network host --entrypoint curl hope-voice-api-voice:latest "$@"
+          }
+          host_curl -sf http://127.0.0.1:8092/health -o /dev/null
+          host_curl -sfk https://127.0.0.1:9178/ -o /dev/null
+          test "$(host_curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401

scripts/deploy-unraid.sh

@@ -15,6 +15,11 @@ if [ ! -d /mnt/user/dev/hope-voice-api/certs ]; then
     --mount type=bind,source=/mnt/user/dev/hope-voice-api/certs,target=/certs,readonly \
     hope-voice-api-voice:latest -d /certs
 fi
+# The runner also has its own loopback network. Probe the host namespace through
+# a short-lived container, without exposing private control endpoints on the LAN.
+host_curl() {
+  docker run --rm --network host --entrypoint curl hope-voice-api-voice:latest "$@"
+}
 STAMP=$(date -u +%Y%m%dT%H%M%SZ)
 BACKUP="$ROOT/rollback/$STAMP"
 mkdir -p "$BACKUP"
@@ -70,7 +75,7 @@ docker run -d --name hope-control --network host --restart unless-stopped \
   -v /var/run/docker.sock:/var/run/docker.sock \
   --log-opt max-size=10m --log-opt max-file=3 hope-voice-control:latest >/dev/null
 for attempt in $(seq 1 30); do
-  if curl -sf http://127.0.0.1:8092/health -o /dev/null; then break; fi
+  if host_curl -sf http://127.0.0.1:8092/health -o /dev/null; then break; fi
   if [ "$attempt" = 30 ]; then false; fi
   sleep 2
 done
@@ -87,6 +92,6 @@ for attempt in $(seq 1 30); do
   if [ "$attempt" = 30 ]; then false; fi
   sleep 2
 done
-test "$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
+test "$(host_curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
 trap - ERR
 printf 'Deployment healthy; rollback containers retained with suffix %s\n' "$STAMP"

tests/unit/test_deploy_rollback.py

@@ -30,6 +30,10 @@ elif cmd=='rm':
  assert c['id'] not in ['original-voice','original-control']
  s['containers'].remove(c);save()
 elif cmd=='run':
+ if '--entrypoint' in a:
+  entry=a[a.index('--entrypoint')+1]
+  if entry=='curl' and '%{http_code}' in a:print('401')
+  sys.exit(0)
  name=a[a.index('--name')+1]
  if name=='voice' and s['failure']=='run':sys.exit(9)
  s['containers'].append({'name':name,'id':'new-'+name,'running':True});save()