Merge pull request 'fix(cac): healthcheck fails only on no answer or 5xx, not 4xx' (#34) from fix/healthcheck-4xx into trunk

Dockerfile

@@ -87,7 +87,12 @@ COPY ./configs/whp-security.conf /etc/httpd/conf.d/
 # Set up cron job in a single layer
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
 
+## Healthy = Apache answered with anything but a 5xx. `curl -f` also failed on
+## 4xx, so a new site with an empty docroot (403) or an app with no route for /
+## (404) showed unhealthy forever, and WHP's monitor restarted it as "PHP
+## wedged". 000 (no answer) and 5xx (PHP/app error) still fail.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
-  CMD curl -f http://localhost/ || exit 1
+  CMD code=$(curl -s -o /dev/null -m 4 -w '%{http_code}' http://localhost/); \
+      case "$code" in 000|5*) echo "http $code"; exit 1;; esac
 
 ENTRYPOINT [ "/scripts/entrypoint.sh" ]