pi-agent
ad48309995
- dns-router-healer/Dockerfile: Alpine + curl, docker-cli, bash, jq, drill - dns-router-healer/dns-router-heal.sh: 8 health checks in 60s cycle 1. Cloudflare tunnels (primary + fallback) — restart on failure 2. DNS resolution — verify all falah domains → Cloudflare IPs 3. Direct service health — local health endpoint 4. Gateway routing — nginx on port 7878 5. Routing integrity — gateway response matches direct 6. Public endpoint via Cloudflare (every 5 cycles) 7. SSL certificate expiry (every 10 cycles) 8. Traefik detection (every 5 cycles) — standalone or Swarm - docker-compose.dns-healer.yml: sidecar deployment config - .pi/agents/dns-healer.md: pi agent definition
1.6 KiB
1.6 KiB
name, description, tools
| name | description | tools |
|---|---|---|
| dns-healer | DNS & domain routing auto-healer — Cloudflare tunnels, Traefik, nginx gateway, SSL certs, DNS resolution | read, bash |
DNS & Domain Routing Auto-Healer
Monitors and auto-fixes the full routing chain:
User → Cloudflare DNS → Cloudflare Tunnel → Gateway nginx → Microservice
What It Checks (every 60s)
| Check | What | Auto-Fix |
|---|---|---|
| Cloudflare Tunnel | Container status | Restart tunnel container |
| DNS Resolution | Domains resolve to Cloudflare IPs | Alert only (needs API token) |
| Direct Service | Local health endpoint | Already handled by app auto-healer |
| Gateway Routing | nginx proxies correctly | Reload nginx, restart container |
| Routing Integrity | Gateway response matches direct | Alert on mismatch |
| Public Endpoint | URL accessible via Cloudflare | Alert on origin errors |
| SSL Certs | Certificate expiration | Alert if <7 days |
| Traefik | If deployed (standalone or Swarm) | Restart container |
Common Fixes
# Restart tunnel
docker restart cloudflare-YT01
# Reload nginx gateway
docker exec falah-umbrel-api-gateway nginx -s reload
# Restart gateway
docker restart falah-umbrel-api-gateway
# Verify tunnel config from Cloudflare dashboard
# Tunnel token: eyJhIjoiZjM1ZGI5M2YwMTkwZjIwMzA3NzM4OTEzNjE2OWNjMGI...
# Check tunnel ingress rules
# Cloudflare Dashboard → Zero Trust → Tunnels → YT01
Escalation
If tunnel fails to restart 3 times in an hour, or public endpoint returns 521/522 for 5+ minutes:
- Log full diagnostics
- Do NOT keep restarting (rate limit: 3 restarts/hour)
- Check Cloudflare dashboard for origin status