chore: release v1.7.49-alpha

scripts/container-doctor.sh

@@ -15,6 +15,7 @@
 #   6. Bitcoin Knots prune+txindex conflict
 #   7. Containers stuck with exit code 127 (binary not found)
 #   8. Stopped core containers (rootless restart policy workaround)
+#   9. Missing rootless port listeners while Podman still shows published ports
 #
 # Safe to run multiple times (idempotent). Never blocks deploy (exit 0 always).
 #
@@ -31,6 +32,21 @@ FIX_NAMES=()
 
 log() { echo "[$(date +%H:%M:%S)] DOCTOR: $*"; }
 
+podman_rootless() {
+    if [ "$(id -u)" = "0" ] && id archipelago >/dev/null 2>&1; then
+        local archi_uid
+        archi_uid=$(id -u archipelago)
+        sudo -u archipelago env XDG_RUNTIME_DIR="/run/user/$archi_uid" podman "$@"
+    else
+        podman "$@"
+    fi
+}
+
+port_is_listening() {
+    local port="$1"
+    ss -ltn 2>/dev/null | awk '{print $4}' | grep -Eq "(^|:)$port$"
+}
+
 run_fix() {
     local name="$1"
     shift
@@ -374,6 +390,11 @@ print(' '.join(['\"' + a + '\"' if ' ' in a else a for a in args[2:]]))
 # at 0 peers; package pulls fail. The only reliable repair is a stop-all/
 # start-all cycle so pasta + aardvark-dns rebuild the netns from scratch.
 fix_rootless_netns_egress() {
+    # Needs root for nsenter. When doctor runs as the rootless container owner,
+    # a failed nsenter probe is a permissions artifact, not evidence of broken
+    # egress; do not cycle the fleet from that context.
+    [ "$(id -u)" = "0" ] || return 1
+
     local archi_uid
     archi_uid=$(id -u archipelago 2>/dev/null) || return 1
 
@@ -453,6 +474,44 @@ fix_stopped_core_containers() {
     [ ${#restarted[@]} -gt 0 ] && return 0 || return 1
 }
 
+# ── Fix 10: Missing rootless port listeners ─────────────────
+# Rootless Podman can leave a container running with PortBindings still present
+# while the host-side rootlessport process has disappeared. Nginx then returns
+# 502 and direct app ports refuse connections even though `podman ps` looks OK.
+fix_missing_rootless_ports() {
+    local containers
+    containers=$(podman_rootless ps --format '{{.Names}}' 2>/dev/null || true)
+    [ -n "$containers" ] || return 1
+
+    local fixed=false
+    local name
+    for name in $containers; do
+        local ports
+        ports=$(podman_rootless inspect "$name" --format '{{range $p,$bindings := .NetworkSettings.Ports}}{{if $bindings}}{{range $bindings}}{{.HostPort}}{{"\n"}}{{end}}{{end}}{{end}}' 2>/dev/null | sort -u)
+        [ -n "$ports" ] || continue
+
+        local missing=()
+        local port
+        for port in $ports; do
+            [ -n "$port" ] || continue
+            if ! port_is_listening "$port"; then
+                missing+=("$port")
+            fi
+        done
+
+        if [ ${#missing[@]} -gt 0 ]; then
+            log "Restarting $name: missing rootlessport listener(s): ${missing[*]}"
+            if podman_rootless restart "$name" >/dev/null 2>&1; then
+                fixed=true
+            else
+                log "WARN: failed to restart $name for missing rootlessport listener(s)"
+            fi
+        fi
+    done
+
+    $fixed && return 0 || return 1
+}
+
 # ── Main ─────────────────────────────────────────────────────
 
 # If remote host provided, run via SSH
@@ -481,6 +540,7 @@ run_fix "bitcoin-txindex" fix_bitcoin_txindex
 run_fix "exit-127"        fix_exit_127
 run_fix "netns-egress"    fix_rootless_netns_egress
 run_fix "stopped-core"    fix_stopped_core_containers
+run_fix "rootless-ports" fix_missing_rootless_ports
 
 echo ""
 if [ $FIXES_APPLIED -gt 0 ]; then