chore: Add undici package and update health check service to utilize undici's Agent for improved HTTP probing

apps/api/src/services/health-check-service.ts

@@ -1,4 +1,5 @@
 import { connect } from "node:net";
+import { Agent } from "undici";
 import type { Db } from "@cfdm/db";
 import { repos } from "@cfdm/db";
 import type { HealthCheckTarget, IpHealthState } from "@cfdm/shared";
@@ -64,14 +65,33 @@ async function httpProbe(
 ): Promise<ProbeResult> {
   const started = Date.now();
   const path = target.path?.trim() || "/";
-  const url = `http://${ip}${path.startsWith("/") ? path : `/${path}`}`;
+  const pathWithSlash = path.startsWith("/") ? path : `/${path}`;
+  const port = target.port ?? 80;
   const hostHeader = target.hostname || ip;
+  const useTls = port === 443;
+  // For HTTPS probing against a raw IP, set SNI/Host so TLS handshake and vhost routing work.
+  const authorityHost = target.hostname || ip;
+  const url = useTls
+    ? `https://${authorityHost}${pathWithSlash}`
+    : `http://${ip}${pathWithSlash}`;
+  // Custom dispatcher for HTTPS-to-IP: connect to the literal IP, but present hostname via SNI.
+  const dispatcher =
+    useTls && target.hostname
+      ? new Agent({
+          connect: {
+            servername: target.hostname,
+            rejectUnauthorized: false,
+          },
+        })
+      : undefined;
   try {
     const response = await fetch(url, {
       method: "GET",
       headers: { Host: hostHeader },
       signal: AbortSignal.timeout(timeoutMs),
       redirect: "manual",
+      // @ts-expect-error undici dispatcher option is not in fetch types
+      dispatcher,
     });
     const latency = Date.now() - started;
     if (target.expected_status != null) {