#!/bin/bash
# 502 但不是 1033：说明 Cloudflare 连上了隧道，是**回源**失败。
# 本机 curl 200，所以问题在 cloudflared -> relay 这一段。
set -u

echo "════════ 1. 隧道 ingress 配置 ════════"
cat /root/.cloudflared/config.yml 2>/dev/null | sed 's/^/  /'

echo
echo "════════ 2. relay 到底在听哪个地址 ════════"
ss -lntp 2>/dev/null | grep -E '8080|LISTEN' | head -8 | sed 's/^/  /'
echo "  ---"
echo "  127.0.0.1:8080  $(curl -s -o /dev/null -w '%{http_code}' --max-time 5 http://127.0.0.1:8080/v1/health)"
echo "  localhost:8080  $(curl -s -o /dev/null -w '%{http_code}' --max-time 5 http://localhost:8080/v1/health)"
LANIP=$(hostname -I | awk '{print $1}')
echo "  $LANIP:8080  $(curl -s -o /dev/null -w '%{http_code}' --max-time 5 http://$LANIP:8080/v1/health)"

echo
echo "════════ 3. relay 服务日志（最近 20 行）════════"
journalctl -u lanremote-relay -n 20 --no-pager 2>/dev/null | sed 's/^/  /'

echo
echo "════════ 4. relay 有没有报错 ════════"
journalctl -u lanremote-relay -n 100 --no-pager 2>/dev/null \
    | grep -iE 'error|exception|traceback|refused|trace' | tail -8 | sed 's/^/  /'
echo "  （没输出=没有明显报错）"

echo
echo "════════ 5. 本机打一次完整请求，看 relay 怎么回的 ════════"
curl -sv --max-time 8 http://127.0.0.1:8080/v1/health 2>&1 \
    | grep -E '^< HTTP|^< [A-Z]|^> GET|Connection' | head -10 | sed 's/^/  /'

echo
echo "════════ 6. 隧道 metrics 全量 ════════"
curl -s --max-time 5 http://127.0.0.1:20241/metrics 2>/dev/null \
    | grep -E '^cloudflared_tunnel' | sed 's/^/  /'

echo
echo "════════ 7. cloudflared 进程和它的命令行 ════════"
pid=$(pgrep -f 'cloudflared tunnel' | head -1)
echo "  PID=$pid"
[ -n "$pid" ] && tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null | sed 's/^/  /'
echo

echo "════════ 8. cloudflared 自己测一次回源 ════════"
# cloudflared 有 diagnose 子命令，能报出配置和连通性
cloudflared tunnel --config /root/.cloudflared/config.yml ingress validate 2>&1 | tail -12 | sed 's/^/  /'