From fc03399285114cdc31bb6748c2c9d5a5b499e458 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Mon, 13 Apr 2026 21:51:00 +0200
Subject: [PATCH] fix(infra): whitelist /api/health in Traefik to fix CI/CD
 health checks

---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 47175dcc..cb276a3e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,7 +29,7 @@ services:
       - "traefik.http.routers.${PROJECT_NAME:-klz}.middlewares=${AUTH_MIDDLEWARE:-klz-ratelimit,klz-forward,klz-compress}"
 
       # Public Router – paths that bypass Gatekeeper auth (health, SEO, static assets, OG images)
-      - "traefik.http.routers.${PROJECT_NAME:-klz}-public.rule=(${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}) && (PathPrefix(`/_next`) || PathPrefix(`/health`) || PathPrefix(`/login`) || PathPrefix(`/gatekeeper`) || PathPrefix(`/uploads`) || PathPrefix(`/media`) || Path(`/robots.txt`) || Path(`/manifest.webmanifest`) || PathPrefix(`/sitemap`) || PathPrefix(`/api/og`) || PathPrefix(`/opengraph-image`) || PathRegexp(`^/([a-z]{2}/)?(health|login|gatekeeper|uploads|media|robots\\\\.txt|sitemap|api/og|opengraph-image)`))"
+      - "traefik.http.routers.${PROJECT_NAME:-klz}-public.rule=(${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}) && (PathPrefix(`/_next`) || PathPrefix(`/health`) || PathPrefix(`/api/health`) || PathPrefix(`/login`) || PathPrefix(`/gatekeeper`) || PathPrefix(`/uploads`) || PathPrefix(`/media`) || Path(`/robots.txt`) || Path(`/manifest.webmanifest`) || PathPrefix(`/sitemap`) || PathPrefix(`/api/og`) || PathPrefix(`/opengraph-image`) || PathRegexp(`^/([a-z]{2}/)?(health|login|gatekeeper|uploads|media|robots\\\\.txt|sitemap|api/og|api/health|opengraph-image)`))"
       - "traefik.http.routers.${PROJECT_NAME:-klz}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
       - "traefik.http.routers.${PROJECT_NAME:-klz}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
       - "traefik.http.routers.${PROJECT_NAME:-klz}-public.tls=${TRAEFIK_TLS:-false}"