fix(compose): break mc-iam-manager <-> nginx clean-install startup deadlock

bin/installAll.sh

@@ -157,8 +157,12 @@ EXIT_STREAK_THRESHOLD=3
 # depends_on chain automatically (already-running dependencies are a no-op).
 # mc-application-manager/mc-cost-optimizer-* depend on mc-observability-rabbitmq,
 # so the observability backbone wave runs before the app-tier wave.
+# mc-iam-manager-nginx is listed explicitly: mc-iam-manager no longer declares a
+# compose dependency on it (that dependency caused a startup deadlock), but the
+# IAM manager still needs the public-domain endpoints nginx serves to become
+# healthy, so nginx must start in the same wave.
 STARTUP_WAVES=(
-    "mc-infra-connector mc-infra-manager mc-iam-manager mc-iam-manager-post-initial"
+    "mc-infra-connector mc-infra-manager mc-iam-manager-nginx mc-iam-manager mc-iam-manager-post-initial"
     "mc-data-manager mc-web-console-api mc-web-console-front"
     "mc-observability-manager mc-observability-front mc-observability-insight mc-observability-insight-scheduler mc-observability-mcp-grafana mc-observability-mcp-maria mc-observability-mcp-influx mc-observability-log-collector"
     "mc-application-manager mc-workflow-manager mc-cost-optimizer-fe"

conf/docker/conf/mc-iam-manager/0_preset_local.sh

@@ -220,6 +220,7 @@ if [ -n "$MC_IAM_MANAGER_PUBLIC_DOMAIN" ] && [ -n "$MC_IAM_MANAGER_KEYCLOAK_PORT
         -e "s/\${MC_WORKFLOW_MANAGER_PROXY_PORT}/$MC_WORKFLOW_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_DATA_MANAGER_PROXY_PORT}/$MC_DATA_MANAGER_PROXY_PORT/g" \
         -e "s/\${MC_APPLICATION_MANAGER_PROXY_PORT}/$MC_APPLICATION_MANAGER_PROXY_PORT/g" \
+        -e "s/\${MC_OBSERVABILITY_FRONT_PORT}/$MC_OBSERVABILITY_FRONT_PORT/g" \
         "$TEMPLATE_FILE" > "$OUTPUT_FILE"
     echo "✓ nginx.conf generated (HTTP mode)"
 else

conf/docker/conf/mc-iam-manager/0_preset_prod.sh

@@ -62,6 +62,13 @@ echo "  MC_COST_OPTIMIZER_FE_PROXY_PORT: $MC_COST_OPTIMIZER_FE_PROXY_PORT"
 # Copy template file and substitute environment variables
 cp "$TEMPLATE_FILE" "$OUTPUT_FILE" || { echo "Error: Failed to copy template file: $TEMPLATE_FILE → $OUTPUT_FILE"; exit 1; }
 
+if [ -n "$MC_IAM_MANAGER_DOMAIN" ]; then
+    sed -i "s/\${MC_IAM_MANAGER_DOMAIN}/$MC_IAM_MANAGER_DOMAIN/g" "$OUTPUT_FILE"
+    echo "✓ MC_IAM_MANAGER_DOMAIN substitution done: $MC_IAM_MANAGER_DOMAIN"
+else
+    echo "Warning: MC_IAM_MANAGER_DOMAIN environment variable is not set."
+fi
+
 if [ -n "$MC_IAM_MANAGER_PORT" ]; then
     sed -i "s/\${MC_IAM_MANAGER_PORT}/$MC_IAM_MANAGER_PORT/g" "$OUTPUT_FILE"
     echo "✓ MC_IAM_MANAGER_PORT substitution done: $MC_IAM_MANAGER_PORT"

conf/docker/conf/mc-iam-manager/nginx.template.conf

@@ -53,7 +53,9 @@ http {
 
         # Health check endpoint (accessible over HTTP)
         location /health {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -100,7 +102,9 @@ http {
 
         # Health check endpoint (accessible over HTTPS as well)
         location /health {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT}/readyz;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT}/readyz;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -115,7 +119,9 @@ http {
         }
 
         location / {
-            proxy_pass http://mc-iam-manager:${MC_IAM_MANAGER_PORT};
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_iam ${MC_IAM_MANAGER_DOMAIN};
+            proxy_pass http://$upstream_iam:${MC_IAM_MANAGER_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -130,7 +136,11 @@ http {
         }
 
         location /auth/ {
-            proxy_pass http://mc-iam-manager-kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/;
+            resolver 127.0.0.11 valid=10s;
+            set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN};
+            # No URI on variable proxy_pass: the original request URI is passed
+            # through unchanged (a literal URI here would replace the whole path)
+            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

conf/docker/conf/mc-iam-manager/nginx.template.local.conf

@@ -60,7 +60,9 @@ http {
         location /auth/ {
             resolver 127.0.0.11 valid=10s;
             set $upstream_kc ${MC_IAM_MANAGER_KEYCLOAK_DOMAIN};
-            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT}/auth/;
+            # No URI on variable proxy_pass: the original request URI is passed
+            # through unchanged (a literal URI here would replace the whole path)
+            proxy_pass http://$upstream_kc:${MC_IAM_MANAGER_KEYCLOAK_PORT};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

conf/docker/docker-compose.mini.yaml

@@ -232,7 +232,6 @@ services:
     depends_on:
       - mc-iam-manager-db
       - mc-iam-manager-kc
-      - mc-iam-manager-nginx
     environment:
       DATABASE_URL: postgres://${MC_IAM_MANAGER_DATABASE_USER}:${MC_IAM_MANAGER_DATABASE_PASSWORD}@${MC_IAM_MANAGER_DATABASE_HOST}:5432/${MC_IAM_MANAGER_DATABASE_NAME}
       PORT: ${MC_IAM_MANAGER_PORT}
@@ -326,6 +325,9 @@ services:
       - ./container-volume/certbot/www:/var/www/certbot:ro
     depends_on:
       - mc-iam-manager-kc
+    healthcheck:
+      test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ]
+      <<: *default-health-check
     networks:
       - mc-iam-manager-network
 

conf/docker/docker-compose.yaml

@@ -259,8 +259,6 @@ services:
         condition: service_healthy
       mc-iam-manager-kc:
         condition: service_healthy
-      mc-iam-manager-nginx:
-        condition: service_started
       mc-infra-manager:
         condition: service_healthy
     environment:
@@ -367,6 +365,9 @@ services:
       - ./container-volume/certbot/www:/var/www/certbot:ro
     depends_on:
       - mc-iam-manager-kc
+    healthcheck:
+      test: [ "CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1" ]
+      <<: *default-health-check
     networks:
       - mc-iam-manager-network
       - mc-observability-network