Keep /api/health and /api/ready off the public nginx vhost

OP OpenVibers committed 2 Oct 2026 · 0cd61ff566 · 1 file, +6 −0

Requested by finish-f1. Handed to the local harness by the cloud job pr-OpenVibe.Bot-2; done by DeepSeek harness.

Changes

ddiff --git a/deploy/nginx/openvibe.bot.conf b/deploy/nginx/openvibe.bot.conf
iindex 98a560c..b214694 100644
---- a/deploy/nginx/openvibe.bot.conf
++++ b/deploy/nginx/openvibe.bot.conf
@@@ -108,6 +108,12 @@ server {
          proxy_pass http://127.0.0.1:4630;
      }
  
++    # ── Health and readiness: host-local probes only ────────
++    # The app treats /api/health and /api/ready as loopback-only (README); keep them off the public
++    # vhost so a probe uses port 4630 directly. Exact matches outrank the /api/ prefix below.
++    location = /api/health { return 404; }
++    location = /api/ready  { return 404; }
++
      # ── REST API ────────────────────────────────────────────
      location /api/ {
          limit_req zone=ovbot_api burst=20 nodelay;