fix(canary): prod compose can actually start

Three things that all blocked tunnel-start:

1. justfile: dropped set dotenv-load / set export — they pulled
   .env.development into every recipe shell, where empty values
   beat docker compose --env-file .env per shell-env precedence
   (POSTGRES_PASSWORD was the visible casualty). Dev recipes now
   pass --env-file .env.development explicitly so they're not
   affected by the change.

2. canary image is distroless/static, so the wget-based healthcheck
   had no binary to run and every check failed → nginx/tunnel never
   started. Added cmd/healthcheck (tiny Go HTTP probe of /healthz),
   built alongside canary, swapped compose healthcheck to /healthcheck.

3. Added tunnel-build and tunnel-rebuild recipes so the next person
   doesn't have to remember which compose files the tunnel overlay
   needs.

PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go

@@ -0,0 +1,27 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+const (
+	healthURL  = "http://127.0.0.1:8080/healthz"
+	httpDialTO = 2 * time.Second
+)
+
+func main() {
+	client := &http.Client{Timeout: httpDialTO}
+	resp, err := client.Get(healthURL)
+	if err != nil {
+		os.Exit(1)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		os.Exit(1)
+	}
+}

PROJECTS/beginner/canary-token-generator/compose.yml

@@ -65,7 +65,7 @@ services:
       redis:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
+      test: ["CMD", "/healthcheck"]
       interval: 10s
       timeout: 5s
       retries: 3

PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod

@@ -27,11 +27,18 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -o /out/canary \
     ./cmd/canary
 
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags="-s -w" \
+    -o /out/healthcheck \
+    ./cmd/healthcheck
+
 FROM gcr.io/distroless/static:nonroot AS final
 
 WORKDIR /
 
 COPY --from=builder /out/canary /canary
+COPY --from=builder /out/healthcheck /healthcheck
 COPY --from=builder /src/config.yaml /config.yaml
 
 EXPOSE 8080

PROJECTS/beginner/canary-token-generator/justfile

@@ -3,9 +3,6 @@
 # justfile
 # =============================================================================
 
-set dotenv-filename := ".env.development"
-set dotenv-load
-set export
 set shell := ["bash", "-uc"]
 set windows-shell := ["powershell.exe", "-NoLogo", "-Command"]
 
@@ -168,6 +165,14 @@ tunnel-start *ARGS:
 tunnel-down *ARGS:
     docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml down {{ARGS}}
 
+[group('tunnel')]
+tunnel-build *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build {{ARGS}}
+
+[group('tunnel')]
+tunnel-rebuild:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build --no-cache
+
 [group('tunnel')]
 tunnel-logs:
     docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml logs -f cloudflared
@@ -178,35 +183,35 @@ tunnel-logs:
 
 [group('dev')]
 dev-up *ARGS:
-    docker compose -f dev.compose.yml up {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml up {{ARGS}}
 
 [group('dev')]
 dev-start *ARGS:
-    docker compose -f dev.compose.yml up -d {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml up -d {{ARGS}}
 
 [group('dev')]
 dev-down *ARGS:
-    docker compose -f dev.compose.yml down {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml down {{ARGS}}
 
 [group('dev')]
 dev-stop:
-    docker compose -f dev.compose.yml stop
+    docker compose --env-file .env.development -f dev.compose.yml stop
 
 [group('dev')]
 dev-build *ARGS:
-    docker compose -f dev.compose.yml build {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml build {{ARGS}}
 
 [group('dev')]
 dev-rebuild:
-    docker compose -f dev.compose.yml build --no-cache
+    docker compose --env-file .env.development -f dev.compose.yml build --no-cache
 
 [group('dev')]
 dev-logs *SERVICE:
-    docker compose -f dev.compose.yml logs -f {{SERVICE}}
+    docker compose --env-file .env.development -f dev.compose.yml logs -f {{SERVICE}}
 
 [group('dev')]
 dev-ps:
-    docker compose -f dev.compose.yml ps
+    docker compose --env-file .env.development -f dev.compose.yml ps
 
 # =============================================================================
 # Utilities