V6 complete

docs/cloudflare_tunnel_access.md

@@ -53,6 +53,12 @@ Validate tunnel container:
 docker compose --env-file .env.production -f docker-compose.production.yml logs cloudflared
 ```
 
+LXC/proxied-network note:
+
+- The `cloudflared` service is pinned to `--protocol http2` with explicit DNS resolvers (`1.1.1.1`, `1.0.0.1`) in `docker-compose.production.yml`.
+- This avoids environments where Docker's embedded resolver (`127.0.0.11`) cannot resolve `region*.v2.argotunnel.com`, which causes connector precheck failure and tunnel shutdown.
+- If tunnel status is still down, verify host/container egress for DNS and TCP 443 to `api.cloudflare.com` and `*.argotunnel.com`.
+
 ## 5. Security notes
 
 - Keep `postgres` and other internal-only services off public hostnames unless required.

docs/production-runbook.md

@@ -25,7 +25,8 @@ This runbook is the operational checklist for releasing and monitoring the trans
 2. Validate service startup:
    - `/healthz` responds `200`
    - if `RUN_EMBEDDED_WORKER=true`, `worker.state` is `running`
-   - if `RUN_EMBEDDED_WORKER=false`, validate `worker` container is healthy/running in Compose
+   - if `RUN_EMBEDDED_WORKER=false`, validate `worker` container is running in Compose
+     (worker healthcheck is intentionally disabled because it does not expose `/healthz`)
    - validate `cloudflared` logs show active tunnel routes and no ingress errors
 3. Execute one smoke workflow:
    - create a document/job with at least one source
@@ -98,6 +99,8 @@ This runbook is the operational checklist for releasing and monitoring the trans
 2. Confirm `deploy/cloudflared/config.yml` hostname mappings are correct.
 3. Confirm `CLOUDFLARE_TUNNEL_TOKEN` in `.env.production` matches the tunnel configured in Cloudflare.
 4. Confirm Cloudflare Access app policy includes the intended identity/group for that hostname.
+5. If logs show SRV/DNS failures via `127.0.0.11`, use the compose-defined resolver override
+   (`dns: 1.1.1.1, 1.0.0.1`) and ensure outbound TCP 443 is allowed.
 
 ### Backup or restore failure
 

docs/v6_0_hosting_migration_plan.md

@@ -53,6 +53,7 @@ Implemented workflow references:
 
 - `deploy/cloudflared/config.yml.example`
 - `docs/cloudflare_tunnel_access.md`
+- `docker-compose.production.yml` (`cloudflared` forced to `--protocol http2` + explicit DNS resolvers for LXC reliability)
 
 ## 3.4 Backup, restore, rollback