expose health/indexer-progress + add /api/* redirects on ordpool.space

Two related changes:

1. Rename /api/v1/internal/indexer-progress → /api/v1/health/indexer-progress
   and drop the localhost gate. The gate was a no-op anyway: cloudflared
   forwards to 127.0.0.1:8999 on happysrv, so every public request
   already passes the isLocal check. Body is non-sensitive operational
   data (lastSuccessAt, lagMinutes, skippedCount) — safe to expose.
   Renaming clarifies the intent: this is a health endpoint.

2. Add 301 redirects on Pages for /api/* and /api/v1/* → api.ordpool.space.
   ordpool is a mempool fork; users follow mempool's docs and expect
   those examples to work against ordpool.space too. The v2 SPA uses
   absolute apiBaseUrl, so this only matters for external API consumers
   (curl, scripts, the upstream docs and FAQ examples).

Updated comment in ordpool-missing-stats.ts referring to the old path.
healthcheck-ping.sh path bump ships separately (deploy-happyserver repo).

Author: hans-crypto

backend/src/api/explorer/_ordpool/ordpool.routes.ts

@@ -9,8 +9,8 @@ import { Aggregation, ChartType, Interval } from './ordpool-statistics-interface
 import ordpoolStatisticsApi from './ordpool-statistics.api';
 
 /** If the indexer hasn't recorded a per-block success in this many minutes,
- *  the /internal/indexer-progress endpoint returns 503 and the heartbeat
- *  script (deploy-happyserver/scripts/healthcheck-ping.sh) skips its OK ping,
+ *  /api/v1/health/indexer-progress returns 503 and the heartbeat script
+ *  (deploy-happyserver/scripts/healthcheck-ping.sh) skips its OK ping,
  *  triggering a Healthchecks.io grace-expiry alert. */
 const MAX_LAG_MINUTES = 30;
 
@@ -19,26 +19,21 @@ class GeneralOrdpoolRoutes {
   public initRoutes(app: Application): void {
     app
       .get(config.MEMPOOL.API_URL_PREFIX + 'ordpool/statistics/:type/:interval/:aggregation', this.$getOrdpoolStatistics)
-      .get(config.MEMPOOL.API_URL_PREFIX + 'internal/indexer-progress', this.$getIndexerProgress)
+      .get(config.MEMPOOL.API_URL_PREFIX + 'health/indexer-progress', this.$getIndexerProgress)
       .get('/content/:inscriptionId', this.getInscriptionContent)
       .get('/preview/:inscriptionId', this.getInscriptionPreview);
   }
 
   /**
-   * Internal liveness endpoint. Returns 200 with the indexer's last-success
-   * timestamp + skipped-block count when the indexer is making progress
-   * (lag < MAX_LAG_MINUTES). Returns 503 when stale. Localhost-only — the
-   * cloudflared tunnel forwards /api/v1/* but production access from the
-   * outside is rejected here, since this endpoint exposes internal state.
+   * Public health endpoint. Returns 200 with the indexer's last-success
+   * timestamp + skipped-block count when the missing-stats indexer is making
+   * progress (lag <= MAX_LAG_MINUTES); 503 when stale. The body is
+   * non-sensitive operational data — safe for the heartbeat script to poll
+   * locally and for users to view in the browser.
+   *
+   * @returns JSON `{ ok, lastSuccessAt, lagMinutes, maxLagMinutes, skippedCount }`.
    */
   private async $getIndexerProgress(req: Request, res: Response): Promise<void> {
-    const remote = req.ip || req.socket.remoteAddress || '';
-    const isLocal = remote === '127.0.0.1' || remote === '::1' || remote === '::ffff:127.0.0.1';
-    if (!isLocal) {
-      res.status(403).send('Forbidden');
-      return;
-    }
-
     try {
       const lastSuccessAt = OrdpoolMissingStats.getLastSuccessAt();
       const skippedCount = await ordpoolSkippedBlocksRepository.getSkippedCount();

backend/src/api/ordpool-missing-stats.ts

@@ -71,7 +71,7 @@ class OrdpoolMissingStats {
 
   /**
    * Wall-clock timestamp of the last per-block successful save. Read by the
-   * /api/v1/internal/indexer-progress route to prove the indexer is making
+   * /api/v1/health/indexer-progress route to prove the indexer is making
    * progress; the heartbeat script alerts when this goes stale.
    */
   private lastSuccessAt: number | null = null;

frontend/src/_redirects

@@ -7,6 +7,16 @@
 /content/* https://api.ordpool.space/content/:splat 301
 /preview/* https://api.ordpool.space/preview/:splat 301
 
+# mempool.space-shape /api/* URLs. ordpool is a mempool fork; users
+# follow mempool's docs and expect those examples to work against
+# ordpool.space too. The v2 SPA itself uses absolute apiBaseUrl
+# 'https://api.ordpool.space', so this 301 only fires for external
+# API consumers (curl, scripts, the upstream docs and FAQ).
+# WebSocket (/api/v1/ws) intentionally not listed — 301 doesn't carry
+# Upgrade headers; WS clients should connect to wss://api.ordpool.space.
+/api/v1/* https://api.ordpool.space/api/v1/:splat 301
+/api/* https://api.ordpool.space/api/:splat 301
+
 # Recursion endpoints — sent to ordinals.com. cat21-ord runs with
 # --index-cat21 and only indexes cats, so it can't answer non-cat
 # recursive lookups. /r/* is the modern form; the four below are the