V6 complete

README.md

@@ -139,6 +139,11 @@ Services:
 - `postgres`: primary datastore
 - `cloudflared`: tunnel client using mounted ingress config + `CLOUDFLARE_TUNNEL_TOKEN`
 
+Operational defaults in the production compose file:
+
+- worker healthcheck is disabled (the worker process has no HTTP `/healthz` endpoint)
+- cloudflared is pinned to HTTP/2 with explicit DNS resolvers (`1.1.1.1`, `1.0.0.1`) for restricted LXC/container DNS environments
+
 Cloudflare setup files:
 
 1. `copy deploy\cloudflared\config.yml.example deploy\cloudflared\config.yml`

docker-compose.production.yml

@@ -35,6 +35,8 @@ services:
       - app_uploads:/app/uploads
       - app_data:/app/data
       - ./prompts:/app/prompts:ro
+    healthcheck:
+      disable: true
     restart: unless-stopped
 
   postgres:
@@ -59,7 +61,10 @@ services:
     image: cloudflare/cloudflared:2026.8.0
     env_file:
       - .env.production
-    command: tunnel --no-autoupdate --config /etc/cloudflared/config.yml run --token ${CLOUDFLARE_TUNNEL_TOKEN}
+    command: tunnel --no-autoupdate --protocol http2 --config /etc/cloudflared/config.yml run --token ${CLOUDFLARE_TUNNEL_TOKEN}
+    dns:
+      - 1.1.1.1
+      - 1.0.0.1
     depends_on:
       app:
         condition: service_healthy

docs/cloudflare_tunnel_access.md

@@ -53,6 +53,12 @@ Validate tunnel container:
 docker compose --env-file .env.production -f docker-compose.production.yml logs cloudflared
 ```
 
+LXC/proxied-network note:
+
+- The `cloudflared` service is pinned to `--protocol http2` with explicit DNS resolvers (`1.1.1.1`, `1.0.0.1`) in `docker-compose.production.yml`.
+- This avoids environments where Docker's embedded resolver (`127.0.0.11`) cannot resolve `region*.v2.argotunnel.com`, which causes connector precheck failure and tunnel shutdown.
+- If tunnel status is still down, verify host/container egress for DNS and TCP 443 to `api.cloudflare.com` and `*.argotunnel.com`.
+
 ## 5. Security notes
 
 - Keep `postgres` and other internal-only services off public hostnames unless required.

docs/production-runbook.md

@@ -25,7 +25,8 @@ This runbook is the operational checklist for releasing and monitoring the trans
 2. Validate service startup:
    - `/healthz` responds `200`
    - if `RUN_EMBEDDED_WORKER=true`, `worker.state` is `running`
-   - if `RUN_EMBEDDED_WORKER=false`, validate `worker` container is healthy/running in Compose
+   - if `RUN_EMBEDDED_WORKER=false`, validate `worker` container is running in Compose
+     (worker healthcheck is intentionally disabled because it does not expose `/healthz`)
    - validate `cloudflared` logs show active tunnel routes and no ingress errors
 3. Execute one smoke workflow:
    - create a document/job with at least one source
@@ -98,6 +99,8 @@ This runbook is the operational checklist for releasing and monitoring the trans
 2. Confirm `deploy/cloudflared/config.yml` hostname mappings are correct.
 3. Confirm `CLOUDFLARE_TUNNEL_TOKEN` in `.env.production` matches the tunnel configured in Cloudflare.
 4. Confirm Cloudflare Access app policy includes the intended identity/group for that hostname.
+5. If logs show SRV/DNS failures via `127.0.0.11`, use the compose-defined resolver override
+   (`dns: 1.1.1.1, 1.0.0.1`) and ensure outbound TCP 443 is allowed.
 
 ### Backup or restore failure
 

docs/v6_0_hosting_migration_plan.md

@@ -53,6 +53,7 @@ Implemented workflow references:
 
 - `deploy/cloudflared/config.yml.example`
 - `docs/cloudflare_tunnel_access.md`
+- `docker-compose.production.yml` (`cloudflared` forced to `--protocol http2` + explicit DNS resolvers for LXC reliability)
 
 ## 3.4 Backup, restore, rollback