From e554279fc31a28ea877a27fca23846fce0830ba0 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 10:52:19 +0200 Subject: [PATCH] fix(birdnet-pi): healthcheck must select https for ssl=true and use POSIX redirection The healthcheck CMD hardcoded http://, but 92-ssl.sh switches Caddy to https://:8081 when ssl=true, so the probe would fail with the wrong scheme. Select the scheme from the ssl env var and pass -k (the probe hits 127.0.0.1, not the certificate's real name). Also replace `&>/dev/null` with `>/dev/null 2>&1`. HEALTHCHECK's shell form runs under /bin/sh, which in this image is dash, not bash. Dash parses `cmd &>/dev/null` as `cmd &` (backgrounded) followed by a separate no-op `>/dev/null`, discarding curl's exit status entirely -- so the healthcheck always reported healthy regardless of whether the WebUI actually responded. Verified under dash directly: no listener -> exit 1, http server -> exit 0, forced scheme mismatch -> exit 1, https with self-signed cert + -k -> exit 0. Co-Authored-By: Claude Sonnet 5 --- birdnet-pi/CHANGELOG.md | 1 + birdnet-pi/Dockerfile | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/birdnet-pi/CHANGELOG.md b/birdnet-pi/CHANGELOG.md index 0015dfec38..e6296ebe5f 100644 --- a/birdnet-pi/CHANGELOG.md +++ b/birdnet-pi/CHANGELOG.md @@ -1,5 +1,6 @@ ## 2026.07.22 (22-07-2026) - Fix: health-check the WebUI port (8081) instead of port 80, so the standalone Docker container no longer reports "unhealthy" when ssl=false +- Fix: health-check now probes https when ssl is enabled, and no longer silently reports "healthy" regardless of the actual result (the previous check's `&>` redirection is a bash-ism that dash, the image's /bin/sh, parses as background + no-op, discarding curl's exit status) ## 2026.07.10 (10-07-2026) - Minor bugs fixed ## 2026.06.01 (19-06-2026) diff --git a/birdnet-pi/Dockerfile b/birdnet-pi/Dockerfile index 5d3a3ab477..5b8c0eed26 100644 --- a/birdnet-pi/Dockerfile +++ b/birdnet-pi/Dockerfile @@ -241,6 +241,11 @@ RUN \ # Health-check the actual WebUI port. In standalone Docker (no Supervisor) nginx # is disabled and Caddy serves the UI on 8081; nothing listens on port 80 when # ssl=false, which made the container report "unhealthy" even though it worked. +# Select https when ssl is enabled (92-ssl.sh switches Caddy to https://:8081), +# and use -k since the probe hits 127.0.0.1 rather than the cert's real name. +# Note: the shell form's CMD runs under /bin/sh (dash here, not bash), so this +# avoids "&>" (a bash-only redirection dash parses as background + no-op, +# which silently discarded curl's exit status and made the check always pass). ENV HEALTH_PORT="8081" \ HEALTH_URL="" HEALTHCHECK \ @@ -248,4 +253,4 @@ HEALTHCHECK \ --retries=5 \ --start-period=30s \ --timeout=25s \ - CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1 + CMD scheme=http; case "${ssl:-false}" in true|TRUE|True|1|yes|YES|Yes|on|ON|On) scheme=https ;; esac; curl -A "HealthCheck: Docker/1.0" -s -k -f "${scheme}://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" >/dev/null 2>&1 || exit 1