feat(nginx): Warn when a domain target service is not reachable

A domain could be mapped to a service or port where nothing listens, and
the vhost was generated and reloaded with no signal, leaving a silently
dead route. Proxy setup now probes each target through the same path the
proxy resolves and surfaces a warning when it is unreachable, without
failing the setup or warning when the target simply can't be probed.

Author: nfebe

internal/nginx/manager.go

@@ -325,6 +325,56 @@ func isNginxConfigValid(output string) bool {
 	return !hasError && hasSuccess
 }
 
+// ProbeTarget checks, from inside the nginx container, whether service:port
+// accepts a TCP connection, using the same name resolution the proxy itself
+// uses. The second return value is false when the check could not be performed
+// (no probe tool in the image, nginx container unavailable, unsupported flags),
+// so callers can stay silent instead of reporting a false dead route.
+func (m *Manager) ProbeTarget(service string, port int) (listening bool, checked bool) {
+	if m.config.ContainerName == "" || service == "" {
+		return false, false
+	}
+
+	probe := fmt.Sprintf("nc -z -w2 %s %d", service, port)
+	out, err := exec.Command("docker", "exec", m.config.ContainerName, "sh", "-c", probe).CombinedOutput()
+
+	exitCode := -1
+	if err == nil {
+		exitCode = 0
+	} else if exitErr, ok := err.(*exec.ExitError); ok {
+		exitCode = exitErr.ExitCode()
+	}
+	return interpretProbe(string(out), exitCode)
+}
+
+// interpretProbe classifies a probe's output and exit code. A missing or
+// unsupported probe tool, or a docker/daemon-level failure (container down,
+// exec failed), is not evidence the target is closed, so it is reported as
+// unchecked rather than a dead route. Only a clean exit-1 from the probe
+// itself counts as "not listening".
+func interpretProbe(output string, exitCode int) (listening bool, checked bool) {
+	if exitCode == 0 {
+		return true, true
+	}
+
+	lower := strings.ToLower(output)
+	uncheckable := []string{
+		"not found", "usage", "invalid", "unrecognized",
+		"error response from daemon", "is not running", "no such container",
+		"oci runtime", "exec failed",
+	}
+	for _, s := range uncheckable {
+		if strings.Contains(lower, s) {
+			return false, false
+		}
+	}
+
+	if exitCode == 1 {
+		return false, true
+	}
+	return false, false
+}
+
 func (m *Manager) waitForContainerReady(maxRetries int) error {
 	for i := 0; i < maxRetries; i++ {
 		cmd := exec.Command("docker", "inspect", "-f", "{{.State.Status}}", m.config.ContainerName)

internal/nginx/manager_test.go

@@ -2057,6 +2057,45 @@ func TestGenerateMultiDomainConfig_ContainerPort(t *testing.T) {
 	})
 }
 
+func TestProbeTarget_UncheckedWithoutContainer(t *testing.T) {
+	m := NewManager(&config.NginxConfig{}, "/deployments", "")
+
+	if listening, checked := m.ProbeTarget("web", 80); checked || listening {
+		t.Errorf("probe must report unchecked when no nginx container is configured, got listening=%v checked=%v", listening, checked)
+	}
+	if _, checked := m.ProbeTarget("", 80); checked {
+		t.Error("probe must report unchecked for an empty service name")
+	}
+}
+
+func TestInterpretProbe(t *testing.T) {
+	tests := []struct {
+		name          string
+		output        string
+		exitCode      int
+		wantListening bool
+		wantChecked   bool
+	}{
+		{"open port", "", 0, true, true},
+		{"connection refused", "nc: connect failed: Connection refused", 1, false, true},
+		{"nc missing", "sh: nc: not found", 127, false, false},
+		{"container down", "Error response from daemon: Container abc is not running", 1, false, false},
+		{"no such container", "Error: No such container: nginx", 1, false, false},
+		{"exec failed", "OCI runtime exec failed: exec failed: ...", 126, false, false},
+		{"unknown nonzero", "something weird", 2, false, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			listening, checked := interpretProbe(tt.output, tt.exitCode)
+			if listening != tt.wantListening || checked != tt.wantChecked {
+				t.Errorf("interpretProbe(%q, %d) = (%v, %v), want (%v, %v)",
+					tt.output, tt.exitCode, listening, checked, tt.wantListening, tt.wantChecked)
+			}
+		})
+	}
+}
+
 func TestCreateVirtualHost_WritesMapsConfig(t *testing.T) {
 	tmpDir, err := os.MkdirTemp("", "nginx-maps-*")
 	if err != nil {

internal/proxy/orchestrator.go

@@ -156,6 +156,18 @@ func (o *Orchestrator) setupMultiDomainDeployment(deployment *models.Deployment,
 		result.NginxReloaded = true
 	}
 
+	for _, d := range domains {
+		port := d.ContainerPort
+		if port == 0 {
+			port = 80
+		}
+		if listening, checked := o.nginx.ProbeTarget(d.Service, port); checked && !listening {
+			warning := fmt.Sprintf("target %s:%d for %s is not reachable; the route may be dead", d.Service, port, d.Domain)
+			log.Printf("warning: %s", warning)
+			result.TargetWarnings = append(result.TargetWarnings, warning)
+		}
+	}
+
 	certResults, err := o.ssl.RequestCertificatesForDomains(domains)
 	if err != nil {
 		log.Printf("warning: failed to request certificates: %v", err)
@@ -376,6 +388,7 @@ type SetupResult struct {
 	CertificateResults   []*ssl.CertificateResult `json:"certificate_results,omitempty"`
 	SSLMessage           string                   `json:"ssl_message,omitempty"`
 	SSLError             string                   `json:"ssl_error,omitempty"`
+	TargetWarnings       []string                 `json:"target_warnings,omitempty"`
 }
 
 type ProxyStatus struct {