Tag: cloudflared

The Death That Was Not One: The CLOSE_WAIT Autopsy of cloudflared, the Untraceable Parent, and a Pulse Check Every Ten Minutes

The Hermes public entrance hermes.qaqmin.com returned 530 while the cloudflared process was still running — the autopsy concluded the process lived but the tunnel died: both connections to the Cloudflare edge on port 7844 were CLOSE_WAIT corpses with readyConnections=0, and their far ends sat in the 198.18.x fake-IP range (the tunnel rode the Clash TUN and never self-healed after the proxy side cut it). The autostart search found nothing at all — no service, no scheduled task, no registry Run key, and the startup folder astrbot bat does not contain it either; the parent process had already exited and its origin cannot be proven. The fix came in two layers: restart the tunnel (local ready 200, public back to 302), and for boot persistence do not build a SYSTEM service — the backend and proxy are not yet alive at boot — but a login-level guard: tunnel-watch.ps1 waits 45 seconds after login, starts or restarts only when unhealthy, and runs a health check every ten minutes, made precisely for this recurrence of the process alive and the tunnel dead.