Smoke-test /health for the reachable (200) and unreachable (503) cases

compose.yaml

@@ -3,8 +3,12 @@
 #
 # The two `ports:` blocks below are TEMPORARY. The target state is NPM in front:
 # NPM terminates TLS and is the only path to the web app, and the editors reach
-# PocketBase through an NPM subdomain -- then both port mappings go away (#9). While
-# NPM is not set up yet, the ports are the only way onto the site and the admin UI.
+# PocketBase through an NPM subdomain (#9). NPM still needs a target address and
+# port, so a port stays reachable either way -- the plan is to reach the containers
+# by name over a shared Docker network (e.g. eb-blazor:8080) instead of publishing
+# them on the LAN, and to drop these host mappings that expose the site and admin UI
+# to anyone on the LAN. While NPM is not set up yet, these mappings are the only way
+# onto the site and the admin UI.
 #
 # For local development use the dev overlay on top, which adds host ports and builds
 # the web image from source:
@@ -31,8 +35,9 @@ services:
       - /mnt/user/appdata/pocketbase/pb_data:/pb_data
     ports:
       # TEMPORARY: exposes the admin UI on the LAN (http://<unraid>:8090/_/) while
-      # NPM is not in front yet. Remove once the editors reach PocketBase through an
-      # NPM subdomain (#9) -- until then the admin has no other way in.
+      # NPM is not in front yet. Replace once the editors reach PocketBase through an
+      # NPM subdomain (#9): NPM points at eb-pocketbase:8090 over a shared network, so
+      # this host mapping can go -- until then the admin has no other way in.
       - "8090:8090"
     healthcheck:
       # The image ships this endpoint; the web app waits for it to pass.
@@ -55,6 +60,7 @@ services:
       PocketBase__BaseUrl: http://eb-pocketbase:8090
     ports:
       # TEMPORARY: reach the site on the LAN (http://<unraid>:5000) while NPM is not
-      # in front yet. Replace with the external npm network once NPM terminates TLS
-      # and is the only path in (#9).
+      # in front yet. Replace once NPM terminates TLS and fronts the site (#9): join
+      # the external NPM network and let NPM point at eb-blazor:8080 by name, so this
+      # host mapping can go and the site is no longer open on the LAN.
       - "5000:8080"