update

.env.example

@@ -1,4 +1,4 @@
-TAPM_LISTEN_ADDR=127.0.0.1:8080
+TAPM_LISTEN_ADDR=0.0.0.0:8080
 TAPM_UPDATE_PEERS=10.10.1.122
 TAPM_UPDATE_SSH_USER=root
 TAPM_PUBLIC_URL=https://tapm.scity.us

compose.yaml

@@ -22,7 +22,7 @@ services:
     tmpfs:
       - /tmp:size=16m,mode=1777
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O - \"http://${TAPM_LISTEN_ADDR}/health/ready\""]
+      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:8080/health/ready"]
       interval: 30s
       timeout: 5s
       retries: 3

docs/deployment.md

@@ -9,14 +9,18 @@ each webserver's local HAProxy listener.
 
 Create `tapm.scity.us` in PowerDNS and point it at the existing HAProxy
 frontend. Install the certificate using the existing certificate automation.
-Set `TAPM_LISTEN_ADDR` to each node's physical address when the load balancer
+Set the broker to listen on all addresses on both webservers:
-connects directly to port 8080:
 
-- Webserver-Node1: `10.10.1.121:8080`
+```dotenv
-- Webserver-Node2: `10.10.1.122:8080`
+TAPM_LISTEN_ADDR=0.0.0.0:8080
+```
 
-Restrict port 8080 to the load-balancer addresses. If Nginx terminates TLS on
+The wildcard bind accepts connections through each node's physical address and
-each webserver instead, keep the broker on `127.0.0.1:8080`.
+through the Keepalived address `10.10.1.120` on whichever node currently owns
+it. The container health check independently uses `127.0.0.1:8080`. Restrict
+port 8080 to the load-balancer and trusted management addresses. If Nginx
+terminates TLS locally and neither direct nor Keepalived access is required,
+the broker can instead bind to `127.0.0.1:8080`.
 
 An example virtual host is in
 [`deploy/nginx/tapm.scity.us.conf`](../deploy/nginx/tapm.scity.us.conf).
@@ -111,7 +115,7 @@ On both webservers:
 
 ```sh
 docker compose up -d broker
-curl --fail "http://${TAPM_LISTEN_ADDR}/health/ready"
+curl --fail "http://127.0.0.1:8080/health/ready"
 ```
 
 There is no local application state and no session affinity requirement.