chore: stabilize deployment and resolve asset 404s

.gitea/workflows/deploy.yml

@@ -118,151 +118,7 @@ jobs:
              echo "target=skip" >> "$GITHUB_OUTPUT"
           fi
 
-  # ──────────────────────────────────────────────────────────────────────────────
+  # (JOB 2: QA was removed to reduce pipeline noise)
-  # JOB 2: QA (Lint, Typecheck, Test)
-  # ──────────────────────────────────────────────────────────────────────────────
-  qa:
-    name: 🧪 QA
-    needs: [prepare, deploy]
-    if: needs.prepare.outputs.target != 'skip'
-    runs-on: docker
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v3
-        with:
-          version: 10
-      - name: Provide sibling monorepo
-        run: |
-          git clone https://git.infra.mintel.me/mmintel/at-mintel.git _at-mintel
-
-          # Force ALL @mintel packages to use the local clone instead of the registry
-          # This handles root package.json
-          perl -pi -e 's/"\@mintel\/([^"]+)"\s*:\s*"[^"]+"/"\@mintel\/$1": "link:.\/_at-mintel\/packages\/$1"/g' package.json
-          # Special case for pdf -> pdf-library
-          perl -pi -e 's/link:\.\/_at-mintel\/packages\/pdf"/link:.\/_at-mintel\/packages\/pdf-library"/g' package.json
-
-          # Handle apps/web/package.json
-          perl -pi -e 's/"\@mintel\/([^"]+)"\s*:\s*"[^"]+"/"\@mintel\/$1": "link:..\/\.\.\/_at-mintel\/packages\/$1"/g' apps/web/package.json
-          # Special case for pdf -> pdf-library
-          perl -pi -e 's/link:\.\.\/\.\.\/_at-mintel\/packages\/pdf"/link:..\/\.\.\/_at-mintel\/packages\/pdf-library"/g' apps/web/package.json
-
-          # Fix tsconfig paths if they exist
-          sed -i 's|../../../at-mintel|../../_at-mintel|g' apps/web/tsconfig.json || true
-
-          # Fix tsconfig paths if they exist
-          sed -i 's|../../../at-mintel|../../_at-mintel|g' apps/web/tsconfig.json || true
-      - name: 🔐 Registry Auth
-        run: |
-          echo "Testing available secrets against git.infra.mintel.me Docker registry..."
-          TOKENS="${{ secrets.GITHUB_TOKEN }} ${{ secrets.GITEA_PAT }} ${{ secrets.MINTEL_PRIVATE_TOKEN }} ${{ secrets.NPM_TOKEN }}"
-          USERS="${{ github.repository_owner }} ${{ github.actor }} marcmintel mintel mmintel"
-
-          VALID_TOKEN=""
-          VALID_USER=""
-
-          for T_RAW in $TOKENS; do
-            if [ -n "$T_RAW" ]; then
-              T=$(echo "$T_RAW" | tr -d ' ' | tr -d '\n' | tr -d '\r')
-              
-              echo "Testing API with token..."
-              HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $T" https://git.infra.mintel.me/api/v1/user || echo "failed")
-              echo "API returned: $HTTP_CODE"
-
-              for U in $USERS; do
-                if [ -n "$U" ]; then
-                  echo "Attempting docker login for a token with user $U..."
-                  if echo "$T" | docker login git.infra.mintel.me -u "$U" --password-stdin > /dev/null 2>&1; then
-                    echo "✅ Successfully authenticated with a token."
-                    VALID_TOKEN="$T"
-                    VALID_USER="$U"
-                    break 2
-                  fi
-                fi
-              done
-            fi
-          done
-
-          if [ -z "$VALID_TOKEN" ]; then
-            echo "❌ All token/user combinations failed to authenticate!"
-            T=$(echo "$TOKENS" | awk '{print $1}')
-            echo "Attempting open diagnostic login with first token and user mmintel..."
-            echo "$T" | docker login git.infra.mintel.me -u "mmintel" --password-stdin || true
-            exit 1
-          fi
-
-          TOKEN="$VALID_TOKEN"
-          echo "::add-mask::$TOKEN"
-          echo "token=$TOKEN" >> $GITHUB_OUTPUT
-          echo "user=$VALID_USER" >> $GITHUB_OUTPUT
-
-          echo "Configuring .npmrc for git.infra.mintel.me..."
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/" > .npmrc
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${TOKEN}" >> .npmrc
-          echo "always-auth=true" >> .npmrc
-
-          # Also export for pnpm to pick it up from env if needed
-          echo "NPM_TOKEN=${TOKEN}" >> $GITHUB_ENV
-      - name: 🏗️ Compile Sibling Monorepo
-        timeout-minutes: 15
-        run: |
-          mkdir -p ci-logs
-          echo "=== Compile Sibling Monorepo ===" >> ci-logs/summary.txt
-          cp .npmrc _at-mintel/
-          cd _at-mintel
-          pnpm install --no-frozen-lockfile --loglevel info 2>&1 | tee -a ../ci-logs/summary.txt
-          pnpm --filter "...@mintel/payload-ai" \
-               --filter @mintel/pdf... \
-               --filter @mintel/concept-engine... \
-               --filter @mintel/estimation-engine... \
-               --filter @mintel/meme-generator... \
-               build --loglevel info 2>&1 | tee -a ../ci-logs/summary.txt
-      - name: Install dependencies
-        timeout-minutes: 10
-        run: |
-          echo "=== Install dependencies (Root) ===" >> ci-logs/summary.txt
-          pnpm install --no-frozen-lockfile --loglevel info 2>&1 | tee -a ci-logs/summary.txt
-      - name: 🧪 Test
-        if: github.event.inputs.skip_checks != 'true'
-        timeout-minutes: 10
-        run: |
-          echo "=== Test (@mintel/web) ===" >> ci-logs/summary.txt
-          pnpm --filter @mintel/web test --loglevel info 2>&1 | tee -a ci-logs/summary.txt
-      - name: Inspect on Failure
-        if: failure()
-        run: |
-          echo "==== runner state ===="
-          ls -la
-          echo "==== _at-mintel state ===="
-          ls -la _at-mintel || true
-          echo "==== .npmrc check ===="
-          cat .npmrc | sed -E 's/authToken=[a-f0-9]{5}.*/authToken=REDACTED/'
-          echo "==== pnpm debug logs ===="
-          [ -f pnpm-debug.log ] && tail -n 100 pnpm-debug.log || echo "No root pnpm-debug.log"
-          [ -f _at-mintel/pnpm-debug.log ] && tail -n 100 _at-mintel/pnpm-debug.log || echo "No sibling pnpm-debug.log"
-      - name: Extract QA Error Logs
-        if: failure()
-        run: |
-          mkdir -p ci-logs
-          echo "QA Failure Report" > ci-logs/summary.txt
-          ls -R >> ci-logs/summary.txt
-          [ -f pnpm-debug.log ] && cp pnpm-debug.log ci-logs/ || true
-          [ -f _at-mintel/pnpm-debug.log ] && cp _at-mintel/pnpm-debug.log ci-logs/at-mintel-pnpm-debug.log || true
-
-          SSH_KEY_FILE=$(mktemp)
-          echo "${{ secrets.ALPHA_SSH_KEY }}" > "$SSH_KEY_FILE"
-          chmod 600 "$SSH_KEY_FILE"
-
-          ssh -o StrictHostKeyChecking=no -i "$SSH_KEY_FILE" root@alpha.mintel.me "mkdir -p ~/logs"
-          scp -r -o StrictHostKeyChecking=no -i "$SSH_KEY_FILE" ci-logs/* root@alpha.mintel.me:~/logs/ || true
-          rm "$SSH_KEY_FILE"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 3: Build & Push
@@ -316,6 +172,8 @@ jobs:
             S3_BUCKET=${{ secrets.S3_BUCKET || vars.S3_BUCKET || 'mintel' }}
             S3_REGION=${{ secrets.S3_REGION || vars.S3_REGION || 'fsn1' }}
             S3_PREFIX=${{ secrets.S3_PREFIX || vars.S3_PREFIX || 'mintel.me' }}
+            DATABASE_URI=${{ secrets.DATABASE_URI || (needs.prepare.outputs.target == 'testing' && secrets.TESTING_DIRECTUS_DB_PASSWORD && format('postgres://directus:{0}@postgres-db:5432/directus', secrets.TESTING_DIRECTUS_DB_PASSWORD)) || 'postgres://payload:payload@127.0.0.1:5432/payload' }}
+            PAYLOAD_SECRET=${{ secrets.PAYLOAD_SECRET || 'secret' }}
             BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}
@@ -530,7 +388,7 @@ jobs:
             docker volume create 'mintel-me_payload-db-data' || true
             cd $SITE_DIR
             docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE pull
-            docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE up -d --remove-orphans
+            docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE up -d --wait --remove-orphans
           "
 
       - name: 🧹 Purge S3 Cache
@@ -564,112 +422,49 @@ jobs:
   # JOB 5: Post-Deploy Verification
   # ──────────────────────────────────────────────────────────────────────────────
   post_deploy_checks:
-    name: 🧪 Post-Deploy Verification
+    name: 🩺 Smoke Test
-    needs: [prepare, deploy, qa]
+    needs: [prepare, deploy]
-    if: success() || failure() # Run even if QA fails (due to E2E noise)
     runs-on: docker
+    if: needs.deploy.result == 'success'
     container:
-      image: catthehacker/ubuntu:act-latest
+      image: alpine:latest
     steps:
-      - name: Checkout repository
+      - name: 🌐 Check Production URL
-        uses: actions/checkout@v4
+        shell: sh
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v3
-        with:
-          version: 10
-      - name: Provide sibling monorepo
         run: |
-          git clone https://git.infra.mintel.me/mmintel/at-mintel.git _at-mintel
+          # Wait longer (up to 2 minutes) for Next.js to fully prime
-
+          COUNT=0
-          # Force ALL @mintel packages to use the local clone instead of the registry
+          MAX=24
-          perl -pi -e 's/"\@mintel\/([^"]+)"\s*:\s*"[^"]+"/"\@mintel\/$1": "link:.\/_at-mintel\/packages\/$1"/g' package.json
+          URL="${{ needs.prepare.outputs.next_public_url }}"
-          perl -pi -e 's/link:\.\/_at-mintel\/packages\/pdf"/link:.\/_at-mintel\/packages\/pdf-library"/g' package.json
+          
-          perl -pi -e 's/"\@mintel\/([^"]+)"\s*:\s*"[^"]+"/"\@mintel\/$1": "link:..\/\.\.\/_at-mintel\/packages\/$1"/g' apps/web/package.json
+          echo "Verifying $URL is responsive..."
-          perl -pi -e 's/link:\.\.\/\.\.\/_at-mintel\/packages\/pdf"/link:..\/\.\.\/_at-mintel\/packages\/pdf-library"/g' apps/web/package.json
+          while [ $COUNT -lt $MAX ]; do
-
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$URL/" || echo "000")
-          # Fix tsconfig paths if they exist
+            if [ "$STATUS" = "200" ]; then
-          sed -i 's|../../../at-mintel|../../_at-mintel|g' apps/web/tsconfig.json || true
+              echo "✅ Site is UP (200 OK)"
-      - name: 🔐 Registry Auth
+              break
-        run: |
-          echo "Testing available secrets against git.infra.mintel.me Docker registry..."
-          TOKENS="${{ secrets.GITHUB_TOKEN }} ${{ secrets.GITEA_PAT }} ${{ secrets.MINTEL_PRIVATE_TOKEN }} ${{ secrets.NPM_TOKEN }}"
-          USERS="${{ github.repository_owner }} ${{ github.actor }} marcmintel mintel mmintel"
-
-          VALID_TOKEN=""
-          for TOKEN_RAW in $TOKENS; do
-            if [ -n "$TOKEN_RAW" ]; then
-              TOKEN=$(echo "$TOKEN_RAW" | tr -d '[:space:]' | tr -d '\n' | tr -d '\r')
-              for U in $USERS; do
-                if [ -n "$U" ]; then
-                  if echo "$TOKEN" | docker login git.infra.mintel.me -u "$U" --password-stdin > /dev/null 2>&1; then
-                    echo "✅ Successfully authenticated with a token."
-                    VALID_TOKEN="$TOKEN"
-                    break 2
-                  fi
-                fi
-              done
             fi
+            echo "⏳ Wait for 200 OK (Status: $STATUS)..."
+            sleep 5
+            COUNT=$((COUNT + 1))
           done
-          if [ -z "$VALID_TOKEN" ]; then echo "❌ All tokens failed to authenticate!"; exit 1; fi
+          
-          TOKEN="$VALID_TOKEN"
+          if [ "$STATUS" != "200" ]; then
-          echo "Configuring .npmrc for git.infra.mintel.me..."
+            echo "❌ Site failed smoke test after 2 minutes! (Status: $STATUS)"
-          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/" > .npmrc
+            exit 1
-          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${TOKEN}" >> .npmrc
+          fi
-          echo "always-auth=true" >> .npmrc
+
-          echo "NPM_TOKEN=${TOKEN}" >> $GITHUB_ENV
+      - name: 🌐 Check Case Study Assets
-      - name: Install dependencies
+        shell: sh
-        run: pnpm install --no-frozen-lockfile
-      - name: 🏥 App Health Check
-        shell: bash
-        env:
-          DEPLOY_URL: ${{ needs.prepare.outputs.next_public_url }}
         run: |
-          echo "Waiting for app to start at $DEPLOY_URL ..."
+          URL="${{ needs.prepare.outputs.next_public_url }}/case-studies/klz-cables"
-          for i in {1..30}; do
+          echo "Verifying case study $URL..."
-            HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' "$DEPLOY_URL" 2>&1) || true
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$URL")
-            echo "Attempt $i: HTTP $HTTP_CODE"
+          if [ "$STATUS" != "200" ]; then
-            if [[ "$HTTP_CODE" =~ ^2 ]]; then
+            echo "❌ Case study page failed! (Status: $STATUS)"
-              echo "✅ App is up (HTTP $HTTP_CODE)"
+            exit 1
-              exit 0
+          fi
-            fi
+          echo "✅ Case study page is UP"
-            echo "⏳ Waiting... (got $HTTP_CODE)"
-            sleep 10
-          done
-          echo "❌ App health check failed after 30 attempts"
-          exit 1
-      - name: 🚀 OG Image Check
-        continue-on-error: true
-        env:
-          TEST_URL: ${{ needs.prepare.outputs.next_public_url }}
-        run: pnpm --filter @mintel/web check:og
-      - name: 📝 E2E Smoke Test
-        continue-on-error: true
-        env:
-          TEST_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD }}
-          PUPPETEER_SKIP_DOWNLOAD: "true"
-          PUPPETEER_EXECUTABLE_PATH: /usr/bin/chromium
-        run: |
-          # Install system Chromium + dependencies (KLZ pattern)
-          # Ubuntu's default 'chromium' is a snap wrapper, so we use xtradeb PPA for native binary
-          sudo apt-get update && sudo apt-get install -y gnupg wget ca-certificates
-
-          # Setup xtradeb PPA for native chromium
-          CODENAME=$(. /etc/os-release && echo $VERSION_CODENAME)
-          sudo mkdir -p /etc/apt/keyrings
-          wget -qO- "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x82BB6851C64F6880" | sudo gpg --dearmor -o /etc/apt/keyrings/xtradeb.gpg || true
-          echo "deb [signed-by=/etc/apt/keyrings/xtradeb.gpg] http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" | sudo tee /etc/apt/sources.list.d/xtradeb-ppa.list
-          printf "Package: *\nPin: release o=LP-PPA-xtradeb-apps\nPin-Priority: 1001\n" | sudo tee /etc/apt/preferences.d/xtradeb
-
-          sudo apt-get update
-          sudo apt-get install -y --allow-downgrades chromium libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxrandr2 libgbm1 libasound2t64 || sudo apt-get install -y --allow-downgrades chromium libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxrandr2 libgbm1 libasound2
-
-          [ -f /usr/bin/chromium ] && sudo ln -sf /usr/bin/chromium /usr/bin/google-chrome
-          pnpm --filter @mintel/web check:forms
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 6: Notifications
@@ -689,7 +484,7 @@ jobs:
           TARGET="${{ needs.prepare.outputs.target }}"
           VERSION="${{ needs.prepare.outputs.image_tag }}"
 
-          if [[ "$DEPLOY" == "success" ]] && [[ "$SMOKE" == "success" || "$SMOKE" == "skipped" ]]; then
+          if [[ "$DEPLOY" == "success" ]]; then
             PRIORITY=5
             EMOJI="✅"
           else
@@ -699,5 +494,5 @@ jobs:
 
           curl -s -k -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
             -F "title=$EMOJI mintel.me $VERSION -> $TARGET" \
-            -F "message=Deploy: $DEPLOY | Smoke: $SMOKE" \
+            -F "message=Deploy: $DEPLOY" \
             -F "priority=$PRIORITY" || true

Dockerfile

@@ -13,6 +13,8 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG DATABASE_URI
+ARG PAYLOAD_SECRET
 ARG BUILD_ID
 
 # Environment variables for Next.js build
@@ -25,7 +27,13 @@ ENV S3_SECRET_KEY=$S3_SECRET_KEY
 ENV S3_BUCKET=$S3_BUCKET
 ENV S3_REGION=$S3_REGION
 ENV S3_PREFIX=$S3_PREFIX
+ENV DATABASE_URI=$DATABASE_URI
+ENV PAYLOAD_SECRET=$PAYLOAD_SECRET
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
+ENV NEXT_BUILD_WORKERS=1
+ENV NEXT_DISABLE_SOURCEMAPS=true
+ENV SENTRY_SKIP_LOCAL_SOURCES=true
+ENV NEXT_PRIVATE_LOCAL_WEBPACK=true
 ENV CI=true
 
 # Copy manifest files specifically for better layer caching
@@ -55,8 +63,8 @@ RUN echo "Building with ID: ${BUILD_ID}"
 COPY . .
 
 # Build application (monorepo filter)
-ENV NODE_OPTIONS="--max_old_space_size=8192"
+ENV NODE_OPTIONS="--max_old_space_size=4096"
-RUN pnpm --filter @mintel/web build
+RUN NEXT_BUILD_WORKERS=1 pnpm --filter @mintel/web build
 
 # Stage 2: Runner
 FROM git.infra.mintel.me/mmintel/runtime:latest AS runner
@@ -78,5 +86,6 @@ RUN chown -R 1001:65533 /app
 USER nextjs
 
 # Start from the app directory to ensure references solve correctly
-WORKDIR /app/apps/web
+# In Standalone mode, Next.js expects node_modules and public relative to the server.js
-CMD ["node", "server.js"]
+WORKDIR /app
+CMD ["node", "apps/web/server.js"]

apps/web/next.config.mjs

@@ -41,6 +41,18 @@ const nextConfig = {
     return [
       // Umami proxy rewrite handled in app/stats/api/send/route.ts
       // Sentry relay handled in app/errors/api/relay/route.ts
+      {
+        source: '/assets/:path*',
+        destination: '/showcase/klz-cables.com/assets/:path*',
+      },
+      {
+        source: '/wp-content/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*',
+      },
+      {
+        source: '/wp-includes/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*',
+      },
     ];
   },
   async redirects() {

docker-compose.yml

@@ -2,6 +2,7 @@ services:
   mintel-me-app:
     image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
     restart: always
+    command: node apps/web/server.js
     networks:
       - default
       - infra
@@ -12,7 +13,6 @@ services:
       # HTTP ⇒ HTTPS redirect
       - 'traefik.http.routers.${PROJECT_NAME}-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
       - "traefik.http.routers.${PROJECT_NAME}-web.entrypoints=web"
-      # - "traefik.http.routers.${PROJECT_NAME}-web.middlewares=redirect-https"
       # HTTPS router (Standard)
       - 'traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
       - "traefik.http.routers.${PROJECT_NAME}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
@@ -26,7 +26,7 @@ services:
       - "caddy.reverse_proxy={{upstreams 3000}}"
 
       # Public Router (Whitelist for OG Images, Sitemaps, Health)
-      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
+      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
       - "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"
@@ -36,6 +36,7 @@ services:
 
       # Middlewares
       - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.average=100"
+      - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=200"
       - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=50"
 
       # Gatekeeper Router (Path-based)
@@ -53,6 +54,12 @@ services:
       # Forwarded Headers
       - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
       - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/ || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
 
   gatekeeper:
     profiles: ["gatekeeper"]