Dockerfile

@@ -49,10 +49,10 @@ USER node
 
 EXPOSE 3001
 
-# HEALTHCHECK — Docker will restart the container if this fails 3 times
-# --no-check-certificate handles self-signed / snakeoil certs.
-# Remove that flag when using a CA-signed certificate.
+# HEALTHCHECK — Docker will restart the container if this fails 3 times.
+# Respects TLS_ENABLED at runtime: uses https (with --no-check-certificate
+# to handle self-signed/snakeoil certs) when TLS is on, plain http when off.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD wget -qO- --no-check-certificate https://localhost:3001/health || exit 1
+  CMD /bin/sh -c '[ "${TLS_ENABLED:-true}" = "false" ] && wget -qO- http://localhost:${PORT:-3001}/health || wget -qO- --no-check-certificate https://localhost:${PORT:-3001}/health'
 
 CMD ["node", "server/index.js"]

docker-compose.yaml

@@ -47,9 +47,9 @@ services:
       - ALL                     # drop all Linux capabilities
     cap_add: []                 # add back none — Node.js needs no special caps
     healthcheck:
-      # Uses --no-check-certificate for self-signed / snakeoil certs.
-      # Remove that flag if using a CA-signed certificate.
-      test: ["CMD", "wget", "-qO-", "--no-check-certificate", "https://localhost:3001/health"]
+      # Respects TLS_ENABLED: uses http when set to false, https otherwise.
+      # --no-check-certificate handles self-signed / snakeoil certs.
+      test: ["CMD", "/bin/sh", "-c", "[ \"${TLS_ENABLED:-true}\" = \"false\" ] && wget -qO- http://localhost:${PORT:-3001}/health || wget -qO- --no-check-certificate https://localhost:${PORT:-3001}/health"]
       interval: 30s
       timeout: 5s
       retries: 3

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sofarr",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "A personal media download dashboard that shows your downloads 'so far' while you relax on the sofa waiting for your *arr services to finish",
   "main": "server/index.js",
   "scripts": {