From bd87baa690cc7174df65e227592d8942bc153938 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 15 Oct 2026 22:31:25 +0200
Subject: [PATCH] fix(cloudflare): drop 10s timeout from tunnel health check
 command

Remove the explicit 10-second timeout from the cloudflared health check so
it uses the default remote process timeout. Add a feature test confirming
the health check runs with sudo on non-root servers, and that the server is
marked as using a Cloudflare tunnel with its IP set to the SSH domain.
---
 .../CloudflareTunnelChangedNotification.php   |  2 +-
 ...loudflareTunnelChangedNotificationTest.php | 49 +++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php

diff --git a/app/Listeners/CloudflareTunnelChangedNotification.php b/app/Listeners/CloudflareTunnelChangedNotification.php
index 34e713f954..3cc44c2f82 100644
--- a/app/Listeners/CloudflareTunnelChangedNotification.php
+++ b/app/Listeners/CloudflareTunnelChangedNotification.php
@@ -26,7 +26,7 @@ class CloudflareTunnelChangedNotification
 
         for ($i = 1; $i <= $attempts; $i++) {
             \Log::debug("Cloudflare health check attempt {$i}/{$attempts}", ['server_id' => $server_id]);
-            $result = instant_remote_process_with_timeout(['docker inspect coolify-cloudflared | jq -e ".[0].State.Health.Status == \"healthy\""'], $this->server, false, 10);
+            $result = instant_remote_process_with_timeout(['docker inspect coolify-cloudflared | jq -e ".[0].State.Health.Status == \"healthy\""'], $this->server, false);
 
             if (blank($result)) {
                 \Log::debug("Cloudflare Tunnels container not found on attempt {$i}", ['server_id' => $server_id]);
diff --git a/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php b/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php
new file mode 100644
index 0000000000..d57f68a4b5
--- /dev/null
+++ b/tests/Feature/Server/CloudflareTunnelChangedNotificationTest.php
@@ -0,0 +1,49 @@
+<?php
+
+use App\Events\CloudflareTunnelChanged;
+use App\Listeners\CloudflareTunnelChangedNotification;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Sleep;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+    config()->set('constants.ssh.max_retries', 1);
+    config()->set('constants.ssh.mux_enabled', false);
+
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $this->server = Server::factory()->create([
+        'team_id' => $team->id,
+        'user' => 'ubuntu',
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+});
+
+it('uses sudo for the health check on a non-root server', function () {
+    Event::fake();
+    Sleep::fake();
+    Process::fake([
+        '*sudo docker inspect coolify-cloudflared*' => Process::result(output: 'true'),
+        '*' => Process::result(errorOutput: 'permission denied while trying to connect to the Docker API', exitCode: 1),
+    ]);
+
+    (new CloudflareTunnelChangedNotification)->handle(new CloudflareTunnelChanged([
+        'server_id' => $this->server->id,
+        'ssh_domain' => 'ssh.example.com',
+    ]));
+
+    expect($this->server->settings->refresh()->is_cloudflare_tunnel)->toBeTruthy()
+        ->and($this->server->refresh()->ip)->toBe('ssh.example.com');
+});