From a4045711af206b5d71d5fb1ca3fd6f90a35174ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Murat=20=C3=96ZDEM=C4=B0R?= Date: Thu, 16 Jul 2026 19:09:34 +0300 Subject: [PATCH] fix(health-agent): point Swag Tls external probe at /health instead of unrouted /actuator/health to stop APISIX 404 noise, enable real TLS verification and require HTTP 200; bump version to 0.2.1 --- health-agent/pyproject.toml | 2 +- health-agent/src/health_agent/checks/tls.py | 16 ++++++++++------ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/health-agent/pyproject.toml b/health-agent/pyproject.toml index 7c3b34e..faa901c 100644 --- a/health-agent/pyproject.toml +++ b/health-agent/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "health-agent" -version = "0.2.0" +version = "0.2.1" description = "iklim.co Monitoring Health Agent" requires-python = ">=3.12" dependencies = [ diff --git a/health-agent/src/health_agent/checks/tls.py b/health-agent/src/health_agent/checks/tls.py index b7cb1ed..157ca56 100644 --- a/health-agent/src/health_agent/checks/tls.py +++ b/health-agent/src/health_agent/checks/tls.py @@ -14,7 +14,7 @@ def check_swag_tls(): cert_path = "/mnt/storagebox/ssl/STAR.iklim.co.full.crt" domain = os.getenv("EXTERNAL_DOMAIN", "iklim.co") suffix = os.getenv("EXTERNAL_SUBDOMAIN_SUFFIX", "") - target_url = f"https://api{suffix}.{domain}/actuator/health" + target_url = f"https://api{suffix}.{domain}/health" msg_parts = [] is_down = False @@ -41,17 +41,21 @@ def check_swag_tls(): is_down = True msg_parts.append(f"cert parse error: {e}") - # 2. Check external HTTPS reachable + # 2. Check external HTTPS reachable with real TLS verification, + # so the served certificate chain is validated, not just the file on disk try: - r = requests.get(target_url, timeout=5, verify=False) - if r.status_code < 500: + r = requests.get(target_url, timeout=5) + if r.status_code == 200: msg_parts.append("HTTPS reachable") else: is_down = True msg_parts.append(f"HTTPS returned {r.status_code}") - except Exception as e: + except requests.exceptions.SSLError: is_down = True - msg_parts.append(f"HTTPS unreachable") + msg_parts.append("TLS verification failed") + except Exception: + is_down = True + msg_parts.append("HTTPS unreachable") ping_ms = int((time.time() - start_t) * 1000) msg = " | ".join(msg_parts)