othrayte/infra
1
0
Fork 0
Code Issues 1 Pull Requests 10 Actions Packages Projects Releases Wiki Activity

improve health checks across all nomad job specs
All checks were successful
CI / Terraform fmt + validate (pull_request) Successful in 27s
Details
CI / Nomad job spec validate (pull_request) Successful in 22s
Details
CI / Docker image pull validation (pull_request) Successful in 16s
Details
CI / Terraform fmt + validate (push) Successful in 23s
Details
CI / Nomad job spec validate (push) Successful in 22s
Details
CI / Docker image pull validation (push) Has been skipped
Details

Browse Source 
- traefik: TCP → HTTP check on /ping (enable ping entrypoint)
- gitea: check path → /api/healthz
- jellyfin: TCP → HTTP check on /health
- glance: TCP → HTTP check on /
- sonarr/prowlarr: check path / → /ping (×2 checks each)
- ntfy/transfer/deluge/openreader/authelia/pgadmin: add name and port to existing checks
- postgres: remove invalid TCP check (Connect-enabled service)
- unifi: TCP → script check via curl (macvlan host isolation workaround)
This commit was merged in pull request #15.
This commit is contained in:
Adrian Cowan
2026-05-26 20:03:19 +10:00
parent 8e32d00d90
commit e695485353
15 changed files with 66 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
2-nomad-config/1-data/pgadmin.nomad.hcl
View File

@@ -58,8 +58,10 @@ job "pgadmin" {
]
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}

4
2-nomad-config/1-data/postgres.nomad.hcl
View File

@@ -7,6 +7,10 @@ job "postgres" {
connect {
sidecar_service {}
}
# Note: TCP checks are not valid for Connect-enabled services (runs through
# Envoy sidecar). Postgres is a single-writer DB that we never canary, so
# observable health via Consul is lower priority than other services.
}
task "postgres" {

2
2-nomad-config/2-ingress/authelia.nomad.hcl
View File

@@ -33,8 +33,10 @@ job "authelia" {
}
check {
name = "alive"
type = "http"
path = "/health"
port = "http"
interval = "10s"
timeout = "2s"
}

6
2-nomad-config/2-ingress/traefik.nomad.hcl
View File

@@ -35,7 +35,8 @@ job "traefik" {
check {
name = "alive"
type = "tcp"
type = "http"
path = "/ping"
port = "api"
interval = "10s"
timeout = "2s"
@@ -85,6 +86,9 @@ api:
dashboard: true
insecure: true
ping:
entryPoint: traefik
providers:
file:
directory: "/etc/traefik/configs/"

4
2-nomad-config/deluge.nomad.hcl
View File

@@ -54,8 +54,10 @@ EOH
]
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}
@@ -78,8 +80,10 @@ EOH
}
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}

4
2-nomad-config/gitea.nomad.hcl
View File

@@ -32,8 +32,10 @@ job "gitea" {
]
check {
name = "alive"
type = "http"
path = "/"
path = "/api/healthz"
port = "http"
interval = "10s"
timeout = "2s"
}

5
2-nomad-config/glance.nomad.hcl
View File

@@ -12,7 +12,7 @@ job "glance" {
driver = "docker"
config {
image = "glanceapp/glance:latest"
image = "glanceapp/glance:v0.7.8"
ports = ["http"]
volumes = [
"local/glance.yml:/app/config/glance.yml",
@@ -30,7 +30,8 @@ job "glance" {
check {
name = "alive"
type = "tcp"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"

5
2-nomad-config/jellyfin.nomad.hcl
View File

@@ -28,10 +28,11 @@ job "jellyfin" {
check {
name = "alive"
type = "tcp"
type = "http"
path = "/health"
port = "http"
interval = "10s"
timeout = "2s"
timeout = "5s"
}
}

2
2-nomad-config/ntfy.nomad.hcl
View File

@@ -33,8 +33,10 @@ job "ntfy" {
]
check {
name = "alive"
type = "http"
path = "/healthz"
port = "http"
interval = "10s"
timeout = "2s"
}

4
2-nomad-config/openreader.nomad.hcl
View File

@@ -31,8 +31,10 @@ job "openreader" {
]
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}
@@ -48,8 +50,10 @@ job "openreader" {
}
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}

6
2-nomad-config/prowlarr.nomad.hcl
View File

@@ -34,8 +34,9 @@ job "prowlarr" {
]
check {
name = "alive"
type = "http"
path = "/"
path = "/ping"
interval = "10s"
timeout = "2s"
}
@@ -51,8 +52,9 @@ job "prowlarr" {
}
check {
name = "alive"
type = "http"
path = "/"
path = "/ping"
interval = "10s"
timeout = "2s"
}

6
2-nomad-config/sonarr.nomad.hcl
View File

@@ -37,8 +37,9 @@ job "sonarr" {
]
check {
name = "alive"
type = "http"
path = "/"
path = "/ping"
interval = "10s"
timeout = "2s"
}
@@ -54,8 +55,9 @@ job "sonarr" {
}
check {
name = "alive"
type = "http"
path = "/"
path = "/ping"
interval = "10s"
timeout = "2s"
}

2
2-nomad-config/transfer.nomad.hcl
View File

@@ -16,8 +16,10 @@ job "transfer" {
]
check {
name = "alive"
type = "http"
path = "/"
port = "http"
interval = "10s"
timeout = "2s"
}

20
2-nomad-config/unifi.nomad.hcl
View File

@@ -21,6 +21,26 @@ job "unifi-network" {
UNIFI_STDOUT = "true"
}
# Register in Consul so Traefik and health checks can find it.
# address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
service {
name = "unifi-network"
port = 8443
address_mode = "driver"
# TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
# isolation). Use a script check instead — it runs inside the container via
# docker exec and connects to localhost:8443 directly.
check {
name = "alive"
type = "script"
command = "/usr/bin/curl"
args = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
interval = "30s"
timeout = "10s"
}
}
volume_mount {
volume = "unraid_appdata_unifi_network"
destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)