milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

.gitea/workflows/ci.yml

@@ -266,16 +266,25 @@ jobs:
           # socket, so a -v path would resolve on the docker host (where the
           # workspace does not exist) and mount an empty directory over
           # /etc/nxdns. docker cp streams the file through the socket instead.
+          #
+          # Networking: this job itself runs in a container on the runner's
+          # per-job network. A published port binds on the daemon's host, not
+          # here, and docker does not route between the default bridge and
+          # that network — a bridge-IP curl hangs to its connect timeout. So
+          # the smoke container joins the job's own network, where its name
+          # resolves and its port is reachable. On a host runner the inspect
+          # finds no container and the published-port path covers it.
+          net=$(docker inspect "$(hostname)" \
+            -f '{{range $k, $v := .NetworkSettings.Networks}}{{$k}}{{end}}' \
+            2>/dev/null || true)
           cid=$(docker create --name nxdns-smoke \
-            -p 127.0.0.1:8080:8080 \
+            ${net:+--network "$net"} \
+            -p 127.0.0.1:18080:8080 \
             nxdns:ci)
           trap 'docker rm -f nxdns-smoke >/dev/null 2>&1 || true' EXIT
           docker cp etc-nxdns/config.zon nxdns-smoke:/etc/nxdns/config.zon
           docker start nxdns-smoke
 
-          # The published port works when the job runs on the docker host or in
-          # DinD; the container IP covers a runner that shares the daemon over
-          # a mounted socket.
           ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$cid")
           healthy=""
           for _ in $(seq 1 30); do
@@ -284,8 +293,9 @@ jobs:
               docker logs "$cid" || true
               exit 1
             fi
-            if curl -fsS "http://127.0.0.1:8080/api/health" \
-              || { [ -n "$ip" ] && curl -fsS "http://$ip:8080/api/health"; }; then
+            if curl -fsS --connect-timeout 2 "http://nxdns-smoke:8080/api/health" \
+              || curl -fsS --connect-timeout 2 "http://127.0.0.1:18080/api/health" \
+              || { [ -n "$ip" ] && curl -fsS --connect-timeout 2 "http://$ip:8080/api/health"; }; then
               healthy=1
               break
             fi