Fix nginx issues #2

.forgejo/workflows/ci.yml

@@ -240,50 +240,42 @@ jobs:
           --password-stdin \
           "${{ secrets.REGISTRY_HOST }}"
 
-      - name: Pull production images (optional but faster on play)
+    - name: (Optional) Pre-pull images to speed up play
       run: |
         podman --remote pull "$REGISTRY_HOST/$APP_NAME/sharenet-backend-api-postgres:$IMAGE_TAG"
         podman --remote pull "$REGISTRY_HOST/$APP_NAME/sharenet-frontend:$IMAGE_TAG"
 
-      # RENDER nginx.conf FROM REPO AND COPY TO HOST (no unshare)
+    # 1) Render nginx.conf from repo and copy to host (no unshare)
     - name: Render nginx.conf and write to host
       run: |
         set -euo pipefail
-          apk add --no-cache gettext >/dev/null  # provides envsubst
+        apk add --no-cache gettext >/dev/null
-          # Render with your CI env (PROD_* vars)
         envsubst < nginx/nginx.conf > /tmp/nginx.conf
-
-          # Copy to host via remote Podman bind-mount; keep prod-service uid/gid
         podman --remote run --rm -i \
           --userns=keep-id \
           -v /opt/sharenet/nginx:/host-nginx:rw \
           alpine:3.20 sh -c 'install -D -m 0644 /dev/stdin /host-nginx/nginx.conf' \
           < /tmp/nginx.conf
 
-      # TRY ZERO-DOWNTIME RELOAD FIRST
+    # 2) Lint nginx.conf BEFORE restarting the pod (avoids crash loops)
-      - name: Reload in-pod Nginx (or restart on failure)
+    - name: Validate nginx.conf with throwaway container
-        continue-on-error: true
       run: |
         set -euo pipefail
-          podman --remote exec sharenet-production-pod-nginx nginx -t
+        podman --remote run --rm \
-          podman --remote exec sharenet-production-pod-nginx nginx -s reload
+          -v /opt/sharenet/nginx:/etc/nginx:ro \
+          docker.io/nginx:alpine \
+          sh -lc 'nginx -t -c /etc/nginx/nginx.conf'
 
-      - name: Fallback restart Nginx container if reload failed
+    # 3) Recreate the pod (down → play). This ensures new images/ports/env + the validated conf.
-        if: failure()
+    - name: Recreate pod
-        run: |
-          set -euo pipefail
-          podman --remote restart sharenet-production-pod-nginx
-
-      # (Re)APPLY THE POD (ensures new images/config picked up)
-      - name: Recreate pod (down & play)
       run: |
         set -euo pipefail
         podman --remote kube down sharenet-production-pod || true
-          # Render your pod manifest (uses same $ENV as before)
         envsubst < deploy/prod-pod.yml | podman --remote kube play -
 
-      # VERIFY
+    # 4) Verify health on the prod host
-      - name: Verify in-pod nginx is healthy
+    - name: Verify in-pod Nginx
       run: |
         set -euo pipefail
         curl -sS -D- http://127.0.0.1:18080/healthz
+