Add unauthenticated /health endpoint to control plane

Returns JSON with status and build version for monitoring and
load balancer health checks.

internal/api/server.go

@@ -28,6 +28,7 @@ var openapiYAML []byte
 type Server struct {
 	router   chi.Router
 	BuildSvc *service.BuildService
+	version  string
 }
 
 // New constructs the chi router and registers all routes.
@@ -48,6 +49,7 @@ func New(
 	mailer email.Mailer,
 	extensions []cpextension.Extension,
 	sctx cpextension.ServerContext,
+	version string,
 ) *Server {
 	r := chi.NewRouter()
 	r.Use(requestLogger())
@@ -86,6 +88,12 @@ func New(
 	adminCapsules := newAdminCapsuleHandler(sandboxSvc, queries, pool, al)
 	meH := newMeHandler(queries, pgPool, rdb, jwtSecret, mailer, oauthRegistry, oauthRedirectURL, teamSvc)
 
+	// Health check.
+	r.Get("/health", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"status":"ok","version":%q}`, version)
+	})
+
 	// OpenAPI spec and docs.
 	r.Get("/openapi.yaml", serveOpenAPI)
 	r.Get("/docs", serveDocs)
@@ -268,7 +276,7 @@ func New(
 		ext.RegisterRoutes(r, sctx)
 	}
 
-	return &Server{router: r, BuildSvc: buildSvc}
+	return &Server{router: r, BuildSvc: buildSvc, version: version}
 }
 
 // Handler returns the HTTP handler.

pkg/cpserver/run.go

@@ -175,7 +175,7 @@ func Run(opts ...Option) {
 	}
 
 	// API server.
-	srv := api.New(queries, hostPool, hostScheduler, pool, rdb, []byte(cfg.JWTSecret), oauthRegistry, cfg.OAuthRedirectURL, ca, al, channelSvc, mailer, o.extensions, sctx)
+	srv := api.New(queries, hostPool, hostScheduler, pool, rdb, []byte(cfg.JWTSecret), oauthRegistry, cfg.OAuthRedirectURL, ca, al, channelSvc, mailer, o.extensions, sctx, o.version)
 
 	// Start template build workers (2 concurrent).
 	stopBuildWorkers := srv.BuildSvc.StartWorkers(ctx, 2)