ci: every nginx upstream must be a container the production web role runs

.github/workflows/nginx-upstreams.yml

@@ -0,0 +1,20 @@
+name: Nginx production upstreams
+on:
+  pull_request:
+    paths: ['file-server/**', 'scripts/after_install.sh', 'docker-compose.yml', 'Makefile', '.github/workflows/nginx-upstreams.yml']
+  push:
+    branches: [edge]
+    paths: ['file-server/**', 'scripts/after_install.sh', 'docker-compose.yml', 'Makefile', '.github/workflows/nginx-upstreams.yml']
+permissions:
+  contents: read
+jobs:
+  upstreams:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.12'}
+      - name: Install template renderer dependency
+        run: sudo apt-get update && sudo apt-get install -y gettext-base
+      - name: Check production upstreams
+        run: make check-nginx-upstreams

Makefile

@@ -442,3 +442,7 @@ check-production-import: ## Run production-import checks
 .PHONY: check-client-errors
 check-client-errors: ## Run client error reporting behaviour and path checks
 	@bash ci/local/client-errors.sh
+
+.PHONY: check-nginx-upstreams
+check-nginx-upstreams: ## Check that production starts every nginx upstream
+	@python3 file-server/nginx/test-production-upstreams.py

docs/local-checks.md

@@ -29,6 +29,7 @@ check. No command reduces the test selection or changes an assertion.
 | Comment recordings | `make check-post-comments-recordings` | Docker, Python 3 |
 | Collective statements | `make check-collective-statement-recordings` | Node 22.23.4, Python 3.12, PostgreSQL 17.11, DynamoDB Local |
 | Delphi characterization | `make check-delphi-characterization` | Node 22.23.4, Python 3.12, PostgreSQL 17.11, DynamoDB Local |
+| Nginx production upstreams | `make check-nginx-upstreams` | Python 3.12, gettext envsubst |
 | Routing recordings | `make check-routing-recordings` | Node 22.23.4, PostgreSQL 17.11 |
 | Route census | `make check-route-census` | Node 22.23.4, Docker; owned Compose project, three distinct ports below 49152 and server/PostgreSQL/OIDC image tags |
 | Server integration | `make check-server-integration` | Node 22.23.4, Python 3, mkcert, Docker |

file-server/nginx/README.md

@@ -122,3 +122,31 @@ when that cached image predates them. `NGINX_RENDERED_DIR` optionally saves
 `nginx -T` output for the tested routes-off and routes-on selections. The
 harness owns a unique container/network prefix and uses ephemeral loopback
 ports. `X54_NGINX_PREFIX` can override that prefix.
+
+### Production upstream check
+
+Run `make check-nginx-upstreams` from the repository root (Python 3.12+ and
+`envsubst`, provided by gettext, are required). The Nginx production upstreams
+workflow runs the same command for changes to the proxy, Compose file or
+production startup hook. No Docker daemon, database or environment file is used.
+
+The check reads the web role's image list and Compose startup commands in
+`scripts/after_install.sh`, compares them with `docker-compose.yml` service
+names and dependencies, then reads every `.template` and `.conf` file below
+the nginx directory. Includes are not followed; included files with other
+extensions are outside coverage. It also runs `render-rust-api.sh` with all route templates selected, using the
+Compose default Rust upstream. Only the renderer's container-local template
+path is relocated to a temporary directory. Literal proxy hosts, upstream
+pool members and host variables defined by `set` or `map` must name a service
+the web role starts. Exceptions belong in `production_upstreams.py` with an
+explanation; the list is currently empty.
+
+This is a source topology check, not a live readiness probe: conditional Rust
+startup counts as available when its routes are selected. Deployment-specific
+environment overrides, DNS reachability and container health are outside its
+scope. The shell and Compose readers support the current explicit startup
+and short dependency-list forms, not general shell evaluation or arbitrary
+YAML. Unsupported startup arguments, dependencies and host variables fail;
+changes to those source forms need matching reader tests. The deployment hook
+is never executed. The test includes the short-lived migration invocation in
+its startup review but does not count it as a serving upstream.