feat: add Docker HEALTHCHECK

[JamBalaya56562]

What

Add a Docker HEALTHCHECK to the acme-companion image so orchestrators (and docker compose up --wait / depends_on: condition: service_healthy) can gate on the companion being up. Closes #709.

Why

app/start.sh launches two background services — letsencrypt_service and the bundled docker-gen — but its wait loop only monitors the docker-gen PID. If letsencrypt_service dies, PID 1 (start.sh) and docker-gen stay alive, so the container keeps reporting up while certificate issuance/renewal has silently stopped. There is currently no signal for this.

How

• app/start.sh records each background PID under /var/run (letsencrypt_service.pid, docker-gen.pid). letsencrypt_service re-execs itself via its EXIT trap (exec $0), which preserves the PID, so the recorded value stays valid across renewal loops.
• New app/healthcheck.sh verifies both PIDs are alive with kill -0 and exits non-zero (with a message) otherwise.
• Dockerfile adds HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD [ "/bin/bash", "/app/healthcheck.sh" ].

I used PID files rather than pgrep on purpose: docker-gen is launched with /app/letsencrypt_service_data.tmpl in its arguments, so pgrep -f letsencrypt_service matches docker-gen too and would mask a dead letsencrypt_service. PID + kill -0 is unambiguous and matches the "verify both background PIDs are alive" direction from the issue.

Tests / docs

• New container_health integration test (added to test/config.sh and the CI matrix, runs under both 2containers and 3containers) waits for the container to report a healthy status.
• docs/Docker-Compose.md gains a short "Health check" section covering compose up --wait and service_healthy.

Verified locally

Built the image and ran a 2-container setup: the container reaches healthy; after kill -9 of the letsencrypt_service PID, healthcheck.sh returns non-zero and Docker flips the container to unhealthy after the retry budget — while the container itself stays "up", which is exactly the blind spot this closes.

Out of scope (deliberately, can add later)

• --start-interval (faster startup gating) needs Docker Engine 25+; omitted for build portability.
• PID-reuse hardening (matching /proc/<pid>/cmdline) — negligible risk in the companion'''s small PID namespace, kept simple.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a Docker image HEALTHCHECK for acme-companion so orchestrators / docker compose up --wait can reliably gate on the companion being “up” (i.e., both letsencrypt_service and the bundled docker-gen are running), addressing issue #709.

Changes:

• Record letsencrypt_service and docker-gen PIDs in /var/run from app/start.sh and introduce app/healthcheck.sh to validate both are alive.
• Add a Dockerfile HEALTHCHECK that runs the new healthcheck script.
• Add an integration test (container_health), wire it into the test list and CI matrix, and document Compose usage.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
app/start.sh	Writes PID files for the two background services for later health verification.
app/healthcheck.sh	New script used by Docker healthcheck to validate both services are alive.
Dockerfile	Adds HEALTHCHECK instruction to the image.
test/tests/container_health/run.sh	New integration test waiting for container health status to become healthy.
test/config.sh	Registers the new container_health test in the suite.
.github/workflows/test.yml	Adds container_health to the CI test matrix.
docs/Docker-Compose.md	Documents how to use the image healthcheck with Compose (--wait / service_healthy).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[buchdag]

@JamBalaya56562 please flag AI-generated PR explicitly in the PR description (ie "🤖 Generated with Claude Code" like in this PR) and add the AI agent as co-author of the commits.

[JamBalaya56562]

@buchdag done, added Claude Code as co-author on the commits. The AI-generated flag is already in the PR description.