iklim.co/Environment_Monitoring
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(health-agent): point Swag Tls external probe at /health instead of unrouted /actuator/health to stop APISIX 404 noise, enable real TLS verification and require HTTP 200; bump version to 0.2.1

Browse Source
This commit is contained in:
Murat ÖZDEMİR 2026-07-16 19:09:34 +03:00
parent 614ade140a
commit a4045711af
2 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
health-agent/pyproject.toml
View File

@ -1,6 +1,6 @@
[project] [project]
name = "health-agent" name = "health-agent"
version = "0.2.0" version = "0.2.1"
description = "iklim.co Monitoring Health Agent" description = "iklim.co Monitoring Health Agent"
requires-python = ">=3.12" requires-python = ">=3.12"
dependencies = [ dependencies = [

16
health-agent/src/health_agent/checks/tls.py
View File

@ -14,7 +14,7 @@ def check_swag_tls():
cert_path = "/mnt/storagebox/ssl/STAR.iklim.co.full.crt" cert_path = "/mnt/storagebox/ssl/STAR.iklim.co.full.crt"
domain = os.getenv("EXTERNAL_DOMAIN", "iklim.co") domain = os.getenv("EXTERNAL_DOMAIN", "iklim.co")
suffix = os.getenv("EXTERNAL_SUBDOMAIN_SUFFIX", "") suffix = os.getenv("EXTERNAL_SUBDOMAIN_SUFFIX", "")
target_url = f"https://api{suffix}.{domain}/actuator/health" target_url = f"https://api{suffix}.{domain}/health"
msg_parts = [] msg_parts = []
is_down = False is_down = False
@ -41,17 +41,21 @@ def check_swag_tls():
is_down = True is_down = True
msg_parts.append(f"cert parse error: {e}") msg_parts.append(f"cert parse error: {e}")
# 2. Check external HTTPS reachable # 2. Check external HTTPS reachable with real TLS verification,
# so the served certificate chain is validated, not just the file on disk
try: try:
r = requests.get(target_url, timeout=5, verify=False) r = requests.get(target_url, timeout=5)
if r.status_code < 500: if r.status_code == 200:
msg_parts.append("HTTPS reachable") msg_parts.append("HTTPS reachable")
else: else:
is_down = True is_down = True
msg_parts.append(f"HTTPS returned {r.status_code}") msg_parts.append(f"HTTPS returned {r.status_code}")
except Exception as e: except requests.exceptions.SSLError:
is_down = True is_down = True
msg_parts.append(f"HTTPS unreachable") msg_parts.append("TLS verification failed")
except Exception:
is_down = True
msg_parts.append("HTTPS unreachable")
ping_ms = int((time.time() - start_t) * 1000) ping_ms = int((time.time() - start_t) * 1000)
msg = " | ".join(msg_parts) msg = " | ".join(msg_parts)