fix: decouple heavy image builds from COMMIT_SHA, fix otel-collector and docs healthchecks

notebooks (10 GB) and zotero (18 GB) now use HEAVY_TAG instead of
COMMIT_SHA so they are not rebuilt on every commit — this was saturating
the network and killing connectivity during deploys.

otel-collector: replace removed loki exporter with otlp_http/loki,
fix deprecated otlp/otlphttp aliases, replace wget healthcheck with
otelcol-contrib validate (scratch image has no shell).

docs: healthcheck wget to 127.0.0.1 instead of localhost (alpine
resolves localhost to ::1 but nginx binds IPv4 only).

Loki: enable allow_structured_metadata for OTLP log ingestion.

Generate STACK_API_SECRET in .env (was missing, caused compose warning).

refs #285, refs #286, refs #287

compose.yml

@@ -244,7 +244,7 @@ services:
     restart: unless-stopped
 
   notebooks:
-    image: ${IMAGE_PREFIX:-fhirworx}/notebooks:${COMMIT_SHA:-latest}
+    image: ${IMAGE_PREFIX:-fhirworx}/notebooks:${HEAVY_TAG:-latest}
     pull_policy: if_not_present
     build:
       context: .
@@ -282,7 +282,7 @@ services:
     restart: unless-stopped
 
   zotero:
-    image: ${IMAGE_PREFIX:-fhirworx}/zotero:${COMMIT_SHA:-latest}
+    image: ${IMAGE_PREFIX:-fhirworx}/zotero:${HEAVY_TAG:-latest}
     pull_policy: if_not_present
     build:
       context: .
@@ -568,13 +568,16 @@ services:
     healthcheck:
       test:
         [
-          "CMD-SHELL",
+          "CMD",
-          "wget --no-verbose --tries=1 --spider http://localhost:13133 || exit 1",
+          "/otelcol-contrib",
+          "validate",
+          "--config",
+          "file:/etc/otelcol-contrib/config.yaml",
         ]
-      interval: 15s
+      interval: 30s
       timeout: 5s
-      retries: 5
+      retries: 3
-      start_period: 15s
+      start_period: 10s
     security_opt:
       - no-new-privileges:true
     restart: unless-stopped

deploy.sh

@@ -7,6 +7,7 @@ set -a; source .env; set +a
 
 PREFIX="${IMAGE_PREFIX:-fhirworx}"
 SHA="${COMMIT_SHA:-latest}"
+HEAVY="${HEAVY_TAG:-latest}"
 
 # ── Helpers ─────────────────────────────────────────────────────────
 log()  { printf '\033[1;34m▸ %s\033[0m\n' "$*"; }
@@ -59,8 +60,8 @@ image_exists() {
 # Services with build: sections that can be built locally if missing
 declare -A BUILDABLE=(
   [mc]="${PREFIX}/mc:${SHA}"
-  [notebooks]="${PREFIX}/notebooks:${SHA}"
+  [notebooks]="${PREFIX}/notebooks:${HEAVY}"
-  [zotero]="${PREFIX}/zotero:${SHA}"
+  [zotero]="${PREFIX}/zotero:${HEAVY}"
   [docs]="${PREFIX}/docs:${SHA}"
   [api]="${PREFIX}/api:${SHA}"
 )

infra/images/docs.Dockerfile

@@ -52,4 +52,4 @@ COPY docs/nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80
 
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
-    CMD wget -qO /dev/null http://localhost:80/ || exit 1
+    CMD wget -qO /dev/null http://127.0.0.1:80/ || exit 1

infra/loki/loki-config.yml

@@ -41,6 +41,7 @@ limits_config:
   reject_old_samples_max_age: 168h
   ingestion_rate_mb: 16
   ingestion_burst_size_mb: 24
+  allow_structured_metadata: true
 
 analytics:
   reporting_enabled: false

infra/otel/otel-collector.yml

@@ -21,13 +21,13 @@ processors:
         action: upsert
 
 exporters:
-  otlp/jaeger:
+  otlp_grpc/jaeger:
     endpoint: jaeger:4317
     tls:
       insecure: true
 
-  loki:
+  otlp_http/loki:
-    endpoint: http://loki:3100/loki/api/v1/push
+    endpoint: http://loki:3100/otlp
 
   prometheus:
     endpoint: 0.0.0.0:8889
@@ -45,7 +45,7 @@ service:
     traces:
       receivers: [otlp]
       processors: [batch, resource]
-      exporters: [otlp/jaeger]
+      exporters: [otlp_grpc/jaeger]
     metrics:
       receivers: [otlp]
       processors: [batch]
@@ -53,4 +53,4 @@ service:
     logs:
       receivers: [otlp]
       processors: [batch, resource]
-      exporters: [loki]
+      exporters: [otlp_http/loki]