ci: e2e — bypass proxy for in-network app host + connectivity diagnostics

.gitea/workflows/ci.yml

@@ -128,7 +128,22 @@ jobs:
           # the job (an orphaned `logs -f` dies on its own when cleanup removes the container).
           E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p flight-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p flight-ci up -d && docker compose -f docker-compose.ci.yml -p flight-ci logs -f"
           E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p flight-ci"
-        run: npx playwright test
+          # Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the
+          # in-network app host out of any proxy path.
+          NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl
+          no_proxy: app,localhost,127.0.0.1,.kkhost.pl
+        run: |
+          # --- e2e connectivity diagnostics (non-fatal; evidence for ERR_SSL_PROTOCOL_ERROR hunt) ---
+          echo "=== proxy env ==="
+          env | grep -iE '^(http_proxy|https_proxy|all_proxy|no_proxy)=' || echo "(none set)"
+          echo "=== /etc/hosts ==="
+          cat /etc/hosts
+          echo "=== DNS for app ==="
+          getent hosts app || echo "getent: no result"
+          echo "=== curl http://app:3000/api/version (node-side) ==="
+          timeout 15 curl -sv http://app:3000/api/version 2>&1 | head -40 || true
+          # --- end diagnostics ---
+          npx playwright test
 
       # The daemon is shared with production — never leave our stack or network behind.
       # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).