docs(onprem): document doctor, certs and offline upgrade bundles for Compose

[Maffooch]

Description

Held until the next dojo-compose-cli release ships. The pages describe commands that are not yet in a released CLI. Every reference uses the same phrase, "the next dojo-compose-cli release after 2.1.5", so the version can be swapped in one pass before merge.

Documents the dojo-compose-cli commands that had no docs page, and reworks the air-gapped upgrade around the new offline bundle.

New page: Checking a Deployment with doctor and certs (docker_compose/checking_a_deployment.md)

• doctor: what each section checks, OK/warning/failure, exit codes, --strict, --offline, and what --fix changes (ownership of media/, and moving DOJO_CLI_KEY and the proxy out of the systemd unit's Environment= lines).
• certs status: what it inspects and when it fails or warns, plus --strict.
• certs add-ca: both CA bundles, --app-only, --connectors-only, --restart, and the rule that options go before file names.
• certs test and certs test --connectors: how to read the OK / FAILED / trust store: output.
• A short table for certs install and certs self-signed, which ship in the same release.

Each of these commands ships in the next dojo-compose-cli release after 2.1.5. 2.1.5 is the latest release and does not include them, so the pages say "the next release" and give no version number. Every section links to the manual steps for older CLIs.

Air-gapped install page

• The upgrade section now starts with the bundle: update the CLI on both hosts, run bundle create on the staging host (--defectdojo-version, --output, --extra-image), then app upgrade --bundle on the air-gapped host. It also explains what the CLI verifies before it changes anything.
• The manual procedure for CLI 2.1.5 and earlier is unchanged, under "Upgrade by hand with an older CLI".
• The app upgrade row in the air-gapped command table mentions --bundle.
• The SSO troubleshooting row keeps the certificate verify failed text, notes that a later DefectDojo release replaces it with a clearer message on the login form, and points the fix to certs add-ca and certs test. It also describes the REQUESTS_CA_BUNDLE set to log line, which from DefectDojo 3.4.0 names a merged file (system roots + /app/certs/private/dojo-ca-bundle.crt).
• The bundle steps cover disk space on both hosts and the order of the checks app upgrade --bundle runs.

Other pages

• Upgrade guide (Compose): the air-gapped section leads with the bundle commands, and a short "Check before and after" section points to doctor.
• Install page: three rows added to the command reference. The internal CA section now shows how to build dojo-ca-bundle.crt from the host's public roots on DefectDojo before 3.4.0, documents the 3.4.0 log line, and points to certs add-ca. This PR does not touch the sections that docs(onprem): recover a Compose first install that gives up during initialization #16298 edits.
• Section index: mentions the new page.

Test results

• npm ci && npm run build -- --environment development and hugo --config config/production/hugo.toml in docs/: both finish with no warnings or errors.
• Checked that every new internal link and anchor resolves in the built public/ output.

Checklist

• Docs only, against dev.

Only the English pages are updated. The translated pages will lag until they are regenerated.

🤖 Generated with Claude Code

[Maffooch]

Review: APPROVE (two rounds), hold the merge until the dojo-compose-cli release

Reviewed by a separate session that did not write this PR. Every flag, default, refusal and quoted message was checked against the dojo-compose-cli source that will ship.

Hold. This branch deploys to docs.defectdojo.com on merge. The commands it documents (doctor, certs, bundle create, app upgrade --bundle) are in no released CLI yet. When that release ships, replace "the next dojo-compose-cli release after 2.1.5" with the real version in one pass (grep -rn "release after 2.1.5" docs/content), then merge.

Fixed after round 1:

• the upgrade page leads with the condition, and both pages give a way to check whether your CLI has bundle;
• no version is promised for the new SSO message;
• the REQUESTS_CA_BUNDLE log line is correct for DefectDojo 3.4.0 and later, on both pages;
• a pre-3.4.0 instruction to build the CA file from the host's public roots plus your own, so the public roots are not lost;
• disk space on both hosts;
• the order of the air-gapped checks;
• the add-ca warning when the host has no public CA bundle;
• the full set of certs status version triggers;
• issue-trackers/ in the carry-over list;
• the nginx-readable failure;
• the upgrade-notes reminder repeated.

Fixed after round 2: the pre-3.4.0 paragraph says to use it instead of the cp command, then restart.

Both builds (development and production) are clean. It merges cleanly with #16298 and #16301.

🤖 Generated with Claude Code