From cfa03071e9cbcf3f793471c483f3cfef714a223d Mon Sep 17 00:00:00 2001
From: "@permadeath.com" <did:plc:nlzmjyfv6loqtxyzvdcznwgf>
Date: Fri, 7 Aug 2026 21:41:34 -0400
Subject: [PATCH] refactor(health): drop the SSM container check

/healthz only returns ok if the api container is serving and the redirect
only happens if Caddy is, so asking the host over SSM confirmed what the
two HTTP checks already had. It cost AWS credentials, tofu, and an `aws
ssm send-command` that argparse in Python 3.14 refuses to build a parser
for, which turned a working host into two FAIL lines.

What remains needs no credentials and runs anywhere.
---
 scripts/health.sh | 29 ++++++++---------------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/scripts/health.sh b/scripts/health.sh
index 40db2fb..f4ec71e 100755
--- a/scripts/health.sh
+++ b/scripts/health.sh
@@ -1,12 +1,16 @@
 #!/usr/bin/env bash
-# Health of the deployed pieces: the site, the API through Caddy, and the
-# containers on the api host. The container check needs AWS credentials and
-# tofu; everything else is plain HTTP.
+# Health of the deployed pieces: the site, and the API through Caddy. Plain
+# HTTP and no credentials, so this runs anywhere.
+#
+# It used to also ask the api host over SSM whether its containers were up.
+# That answered nothing the HTTP checks do not - /healthz only returns ok if
+# the api container is serving, and the redirect only happens if Caddy is -
+# while needing AWS credentials, tofu, and an `aws ssm send-command` that is
+# broken on at least one machine here.
 set -uo pipefail
 
 # No set -e: every check runs, failures are counted, the exit code reports.
 
-ENV_DIR="$(dirname "$0")/../envs/lance.blue"
 failures=0
 
 check() { # name expected actual
@@ -42,21 +46,4 @@ check "api /healthz" ok "$healthz"
 redirect=$(curl -s -m 10 -o /dev/null -w '%{http_code}' http://api.lance.blue/healthz || echo unreachable)
 check "caddy http->https redirect" 308 "$redirect"
 
-instance=$(tofu -chdir="$ENV_DIR" output -raw api_instance_id 2>/dev/null || true)
-if [ -z "$instance" ]; then
-  echo "SKIP  containers: cannot read api_instance_id (AWS credentials?)"
-else
-  cmd_id=$(aws ssm send-command --instance-ids "$instance" \
-    --document-name AWS-RunShellScript \
-    --parameters 'commands=["docker inspect -f {{.State.Status}} api","docker inspect -f {{.State.Status}} caddy","docker ps"]' \
-    --query Command.CommandId --output text)
-  sleep 3
-  out=$(aws ssm get-command-invocation --command-id "$cmd_id" \
-    --instance-id "$instance" --query StandardOutputContent --output text)
-  check "container api" running "$(echo "$out" | sed -n 1p)"
-  check "container caddy" running "$(echo "$out" | sed -n 2p)"
-  echo
-  echo "$out" | tail -n +3
-fi
-
 [ "$failures" -eq 0 ]
-- 
2.51.2