fix: retry production health checks during startup

docs/vps-deployment.md

@@ -81,7 +81,7 @@ The deploy script:
 4. writes the deployed Git revision to `.deploy-revision`
 5. builds the Docker image on the VPS
 6. recreates only the `bmp_website` app container
-7. verifies `/` and `/admin`
+7. verifies `/` and `/admin`, retrying transient startup failures for up to 60 seconds
 
 The required workflow is:
 
@@ -114,6 +114,18 @@ If the Caddy container also needs to be recreated:
 DEPLOY_CADDY=1 pnpm deploy:vps
 ```
 
+The post-deploy verification tolerates brief `502` responses while Next/Payload
+starts. Its retry behavior can be adjusted when needed:
+
+```bash
+VERIFY_RETRIES=30
+VERIFY_RETRY_DELAY_SECONDS=2
+VERIFY_RETRY_MAX_SECONDS=60
+VERIFY_REQUEST_TIMEOUT_SECONDS=20
+```
+
+Set `SKIP_VERIFY=1` only when verification is being performed separately.
+
 ## Payload Migrations
 
 Routine deploys do not run migrations. For schema-changing commits, create and

scripts/deploy-vps.sh

@@ -14,6 +14,10 @@ PUBLIC_URL="${PUBLIC_URL:-https://$APP_DOMAIN}"
 DEPLOY_CADDY="${DEPLOY_CADDY:-0}"
 RUN_MIGRATIONS="${RUN_MIGRATIONS:-0}"
 SKIP_VERIFY="${SKIP_VERIFY:-0}"
+VERIFY_RETRIES="${VERIFY_RETRIES:-30}"
+VERIFY_RETRY_DELAY_SECONDS="${VERIFY_RETRY_DELAY_SECONDS:-2}"
+VERIFY_RETRY_MAX_SECONDS="${VERIFY_RETRY_MAX_SECONDS:-60}"
+VERIFY_REQUEST_TIMEOUT_SECONDS="${VERIFY_REQUEST_TIMEOUT_SECONDS:-20}"
 
 SSH_TARGET="$SSH_USER@$VPS_HOST"
 COMPOSE_FILE="$APP_ROOT/current/deploy/vps/docker-compose.yml"
@@ -86,10 +90,22 @@ ssh -t -i "$SSH_KEY" -p "$VPS_PORT" "$SSH_TARGET" "
   sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'
 "
 
+verify_url() {
+  local url="$1"
+
+  echo "Verifying $url"
+  curl -fsSIL \
+    --retry "$VERIFY_RETRIES" \
+    --retry-all-errors \
+    --retry-delay "$VERIFY_RETRY_DELAY_SECONDS" \
+    --retry-max-time "$VERIFY_RETRY_MAX_SECONDS" \
+    --max-time "$VERIFY_REQUEST_TIMEOUT_SECONDS" \
+    "$url" | sed -n '1,12p'
+}
+
 if [[ "$SKIP_VERIFY" != "1" ]]; then
-  echo "Verifying $PUBLIC_URL"
-  curl -fsSIL --max-time 20 "$PUBLIC_URL/" | sed -n '1,12p'
-  curl -fsSIL --max-time 20 "$PUBLIC_URL/admin" | sed -n '1,12p'
+  verify_url "$PUBLIC_URL/"
+  verify_url "$PUBLIC_URL/admin"
 fi
 
 echo "Deploy complete: $REVISION"