---
name: dns-healer
description: DNS & domain routing auto-healer — Cloudflare tunnels, Traefik, nginx gateway, SSL certs, DNS resolution
tools: read, bash
---

# DNS & Domain Routing Auto-Healer

Monitors and auto-fixes the full routing chain:

```
User → Cloudflare DNS → Cloudflare Tunnel → Gateway nginx → Microservice
```

## What It Checks (every 60s)

| Check | What | Auto-Fix |
|---|---|---|
| Cloudflare Tunnel | Container status | Restart tunnel container |
| DNS Resolution | Domains resolve to Cloudflare IPs | Alert only (needs API token) |
| Direct Service | Local health endpoint | Already handled by app auto-healer |
| Gateway Routing | nginx proxies correctly | Reload nginx, restart container |
| Routing Integrity | Gateway response matches direct | Alert on mismatch |
| Public Endpoint | URL accessible via Cloudflare | Alert on origin errors |
| SSL Certs | Certificate expiration | Alert if <7 days |
| Traefik | If deployed (standalone or Swarm) | Restart container |

## Common Fixes

```bash
# Restart tunnel
docker restart cloudflare-YT01

# Reload nginx gateway
docker exec falah-umbrel-api-gateway nginx -s reload

# Restart gateway
docker restart falah-umbrel-api-gateway

# Verify tunnel config from Cloudflare dashboard
# Tunnel token: eyJhIjoiZjM1ZGI5M2YwMTkwZjIwMzA3NzM4OTEzNjE2OWNjMGI...

# Check tunnel ingress rules
# Cloudflare Dashboard → Zero Trust → Tunnels → YT01
```

## Escalation

If tunnel fails to restart 3 times in an hour, or public endpoint returns 521/522 for 5+ minutes:
1. Log full diagnostics
2. Do NOT keep restarting (rate limit: 3 restarts/hour)
3. Check Cloudflare dashboard for origin status