Add standalone managed ingress diagnostics

2026-08-03 19:59:12 +02:00
parent 6163c5992f
commit d107d94fec
4 changed files with 93 additions and 3 deletions
@@ -181,6 +181,10 @@ host binding configuration, avoiding daemon-specific random-port shorthand
 behavior. Because an Actions job and deployment containers may be Docker
 siblings, functional HTTP/TLS checks run from the digest-pinned API image on
 the deployment network instead of assuming the Docker host is job-local.
+The dispatch-only `Runtime Ingress Drill` workflow exposes the same bounded
+check independently so ingress changes can be diagnosed before an immutable
+runtime publication; it accepts only digest-pinned Caddy, HAProxy, and API
+images and has no push trigger.
 The bounded setup helper writes only generated public configuration as root so
 it can initialize a new volume; the actual HAProxy process retains the image's
 non-root identity and runs read-only with all capabilities dropped.