library: BIND_ADDR for loopback-only mode, real readiness check

- BIND_ADDR (default 0.0.0.0) on every published port; 127.0.0.1 keeps the
  stack reachable from the host only (Docker bypasses ufw, so this is the
  actual control the kiosk addon's 'this kiosk only' choice uses)
- Koha serves its web-installer page with HTTP 200 before the database
  exists, so 'port answers' was not 'ready': the entrypoint now writes
  /run/koha-ready, the healthcheck requires it, and install.sh waits for
  healthy + the quick-add health endpoint

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/docker-compose.yml

@@ -38,8 +38,8 @@ services:
       KOHA_ADMIN_PASS: ${ADMIN_PASSWORD}
       KOHA_LIBRARY_NAME: ${LIBRARY_NAME:-My Library}
     ports:
-      - "${OPAC_PORT:-8080}:80"
+      - "${BIND_ADDR:-0.0.0.0}:${OPAC_PORT:-8080}:80"
-      - "${STAFF_PORT:-8081}:8081"
+      - "${BIND_ADDR:-0.0.0.0}:${STAFF_PORT:-8081}:8081"
     volumes:
       - koha-data:/var/lib/koha
 
@@ -63,7 +63,7 @@ services:
       STAFF_PORT: ${STAFF_PORT:-8081}
       QUICKADD_SOURCES: ${QUICKADD_SOURCES:-z3950:lx2.loc.gov:210/LCDB,openlibrary}
     ports:
-      - "${QUICKADD_PORT:-8082}:8082"
+      - "${BIND_ADDR:-0.0.0.0}:${QUICKADD_PORT:-8082}:8082"
     volumes:
       - quickadd-data:/data
 

library/install.sh

@@ -100,6 +100,7 @@ TZ=${TZ_NOW}
 OPAC_PORT=$(free_port "${OPAC_PORT:-8080}")
 STAFF_PORT=$(free_port "${STAFF_PORT:-8081}")
 QUICKADD_PORT=$(free_port "${QUICKADD_PORT:-8082}")
+BIND_ADDR=${BIND_ADDR:-0.0.0.0}
 ADMIN_USER=admin
 ADMIN_PASSWORD=$(rand 16)
 DB_ROOT_PASSWORD=$(rand 32)
@@ -114,6 +115,9 @@ else
     if ! grep -q '^QUICKADD_PORT=' .env; then
         echo "QUICKADD_PORT=$(free_port 8082)" >> .env
     fi
+    if ! grep -q '^BIND_ADDR=' .env; then
+        echo "BIND_ADDR=${BIND_ADDR:-0.0.0.0}" >> .env
+    fi
 fi
 
 if [ -n "${EXTRA_CA:-}" ]; then
@@ -131,9 +135,10 @@ with_retry dc up -d
 # --- Wait until the site answers ---------------------------------------------------
 # shellcheck disable=SC1091
 . ./.env
-c_info "First start installs the database - waiting for the staff interface..."
+c_info "First start installs the database - waiting until Koha reports healthy..."
-for i in $(seq 1 120); do
+for i in $(seq 1 180); do
-    if curl -fsS -o /dev/null "http://127.0.0.1:$STAFF_PORT/" 2>/dev/null; then READY=1; break; fi
+    health="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' library-koha 2>/dev/null || echo missing)"
+    if [ "$health" = healthy ] && curl -fsS -o /dev/null -m 5 "http://127.0.0.1:${QUICKADD_PORT:-8082}/healthz" 2>/dev/null; then READY=1; break; fi
     # One restart is tolerated (Docker's restart policy); a crash loop is not.
     if [ "$(docker inspect -f '{{.RestartCount}}' library-koha 2>/dev/null || echo 99)" -ge 3 ]; then
         c_err "library-koha keeps crashing - see: docker logs library-koha"; exit 1

library/koha/Dockerfile

@@ -35,6 +35,6 @@ RUN chmod 0755 /opt/koha-init/entrypoint.sh && chmod -R a+rX /opt/koha-init
 
 EXPOSE 80 8081
 VOLUME ["/var/lib/koha"]
-HEALTHCHECK --interval=30s --timeout=10s --start-period=300s --retries=5 \
+HEALTHCHECK --interval=10s --timeout=10s --start-period=300s --retries=6 \
-  CMD curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1
+  CMD test -f /run/koha-ready && curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1
 ENTRYPOINT ["/opt/koha-init/entrypoint.sh"]

library/koha/entrypoint.sh

@@ -15,6 +15,10 @@ export TZ="${TZ:-UTC}"
 
 log() { echo "[koha-init] $*"; }
 
+# Marker the container healthcheck waits for. Before the database exists Koha
+# serves its web-installer page with HTTP 200, so "port answers" is not "ready".
+rm -f /run/koha-ready
+
 # --- 1. memcached (Koha caches sysprefs and sessions in it) -----------------
 memcached -u memcache -m 64 -d
 cron
@@ -105,5 +109,6 @@ apache2ctl -k stop >/dev/null 2>&1 || true
 for i in 1 2 3 4 5; do pgrep -x apache2 >/dev/null || break; sleep 1; done
 rm -f /var/run/apache2/apache2.pid
 
+touch /run/koha-ready
 log "ready - library catalogue on :80, staff interface on :$STAFF_PORT"
 exec apache2ctl -D FOREGROUND