fix(selfhost): pin MinIO images and add application health checks

backend/src/index.ts

@@ -98,10 +98,6 @@ async function main() {
         done()
     })
 
-    app.get('/health', async (req, res) => {
-        return res.send({ status: 'ok' })
-    })
-
     //Plugin nur auf bestimmten Routes
     await app.register(queryConfigPlugin, {
         routes: ['/api/resource/:resource/paginated']

backend/src/routes/health.ts

@@ -2,6 +2,16 @@ import { FastifyInstance } from "fastify";
 import { getBuildInfo } from "../utils/buildInfo";
 
 export default async function routes(server: FastifyInstance) {
+    server.get("/health", async (_request, reply) => {
+        reply.header("Cache-Control", "no-store");
+        try {
+            await server.db.execute("SELECT 1");
+            return { status: "ok", ...getBuildInfo() };
+        } catch {
+            return reply.code(503).send({ status: "unavailable" });
+        }
+    });
+
     server.get("/version", async (_request, reply) => {
         reply.header("Cache-Control", "no-store");
         return getBuildInfo();

backend/tests/buildInfo.test.ts

@@ -3,6 +3,28 @@ import { test } from 'node:test';
 import Fastify from 'fastify';
 import healthRoutes from '../src/routes/health';
 
+test('health checks the database and reports a failure without leaking connection details', async () => {
+    const app = Fastify();
+    let available = true;
+    app.decorate('db', { execute: async () => {
+        if (!available) throw new Error('postgres://secret@database');
+        return { rows: [{ result: 1 }] };
+    } } as any);
+    try {
+        await app.register(healthRoutes);
+        const healthy = await app.inject('/health');
+        assert.equal(healthy.statusCode, 200);
+        assert.equal(healthy.json().status, 'ok');
+        assert.equal(healthy.headers['cache-control'], 'no-store');
+        available = false;
+        const unhealthy = await app.inject('/health');
+        assert.equal(unhealthy.statusCode, 503);
+        assert.deepEqual(unhealthy.json(), { status: 'unavailable' });
+    } finally {
+        await app.close();
+    }
+});
+
 test('version endpoint reports image metadata without a database or authentication', async () => {
     const previousVersion = process.env.FEDEO_VERSION;
     const previousRevision = process.env.FEDEO_REVISION;