Cloudflare tunnel issue with github actions for cloudstack vm

[arpanbht]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

General

Discussion Details

Hey guys I have created a vm inside our cloudstack setup which is having a private ip now i am setting up a github actions runner to deploy our code to the vm and it will auto deploy after that.

For this I am we are using cloudflare tunneling to expose the vm publicly and can ssh into it using cloudflared. Now our deploy yml file is not working...previously it was working and the runner can ssh into the vm but now the setup is failing, its giving bad handshake: 65535 error

Here is our deploy.yml file which we are using to deploy the project into the vm

name: Deploy Node API to cloudbackend.iem.edu.in

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Cloudflare Tunnel
        run: |
          curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o cloudflared.deb
          sudo dpkg -i cloudflared.deb
      - name: Setup SSH Key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/api_deploy
          chmod 600 ~/.ssh/api_deploy
      - name: Setup SSH Config
        run: |
          cat <<EOF > ~/.ssh/config
          Host api-vm
            HostName sshcloudbackend.iem.edu.in
            User ubuntu
            IdentityFile ~/.ssh/api_deploy
            ProxyCommand cloudflared access ssh --hostname %h
            StrictHostKeyChecking no
            UserKnownHostsFile=/dev/null
            ServerAliveInterval 60
            ServerAliveCountMax 10
            TCPKeepAlive yes
          EOF
          chmod 600 ~/.ssh/config
      - name: Test SSH Connection
        run: |
          ssh api-vm "echo SSH OK"
      - name: Install Node.js (if not present)
        run: |
          ssh api-vm "
            if ! command -v node &> /dev/null; then
              echo 'Installing Node.js...'
              curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
              sudo apt-get install -y nodejs
            else
              echo 'Node.js already installed'
            fi
            node -v
            npm -v
          "
      - name: Install and Configure Nginx
        run: |
          ssh api-vm "
            if ! command -v nginx &> /dev/null; then
              sudo apt-get update
              sudo apt-get install -y nginx
              sudo systemctl enable nginx
            fi
            sudo tee /etc/nginx/sites-available/cloudbackend.iem.edu.in > /dev/null <<'NGINX_CONF'
            server {
              listen 80;
              server_name cloudbackend.iem.edu.in;
              location / {
                proxy_pass http://127.0.0.1:8000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade \$http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host \$host;
                proxy_set_header X-Real-IP \$remote_addr;
                proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto \$scheme;
                proxy_read_timeout 300s;
                proxy_connect_timeout 300s;
              }
            }
            NGINX_CONF
            sudo ln -sf /etc/nginx/sites-available/cloudbackend.iem.edu.in /etc/nginx/sites-enabled/
            sudo rm -f /etc/nginx/sites-enabled/default
            sudo nginx -t && sudo systemctl reload nginx
          "
      - name: Create App Directory
        run: |
          ssh api-vm "sudo mkdir -p /var/www/api && sudo chown -R root:root /var/www/api"
      - name: Deploy Backend Code
        run: |
          rsync -avz --delete \
            --exclude=node_modules \
            --exclude=.git \
            -e "ssh" \
            ./ api-vm:/var/www/api/
      - name: Install Dependencies
        run: |
          ssh api-vm "
            cd /var/www/api
            npm ci
          "
      - name: Restart Node Server (sudo)
        run: |
          ssh api-vm "
            cd /var/www/api
            echo '🚀 Starting server...'
            nohup sudo node src/server.js \
              > /var/log/api-server.log 2>&1 &
            sleep 3
          "
      - name: Verify Server
        run: |
          ssh api-vm "
            echo '🔍 Checking process...'
            pgrep -f 'node src/server.js' || exit 1
            echo '🔍 Checking port 8000...'
            ss -lntp | grep ':8000' || exit 1
            echo '📄 Logs:'
            tail -20 /var/log/api-server.log
          "
      - name: Health Check
        run: |
          ssh api-vm "
            echo '⏳ Waiting for server to warm up...'
            sleep 5
            for i in {1..5}; do
              if curl -f http://127.0.0.1:8000/ > /dev/null; then
                echo '✅ Health check passed (local)'
                exit 0
              fi
              echo \"Retry \$i...\"
              sleep 3
            done
            echo '❌ Health check failed'
            exit 1
          "
      - name: Done
        run: |
          echo "🎉 Deployment complete!"

[dbuzatto]

Hi

The bad handshake: 65535 error when using Cloudflare Tunnel + SSH in GitHub Actions is usually related to Cloudflare Access authentication, cloudflared version mismatch, or SSH proxy negotiation issues, not the VM itself.

Here are the most common causes and fixes to check:

1. Cloudflare Access authentication is missing

When using:
ProxyCommand cloudflared access ssh --hostname %h

Cloudflare requires an Access token (service token or short-lived cert).
GitHub Actions runners cannot do interactive login, so if Access policies were changed recently, SSH will fail with handshake errors.

Fix: Use a Cloudflare Service Token

cloudflared access ssh \
  --hostname %h \
  --service-token-id $CF_ACCESS_CLIENT_ID \
  --service-token-secret $CF_ACCESS_CLIENT_SECRET

And store these as GitHub Secrets:

• CF_ACCESS_CLIENT_ID
• CF_ACCESS_CLIENT_SECRET

2. cloudflared version change / breaking update

You are installing latest cloudflared every run:
https://github.com/cloudflare/cloudflared/releases/latest/...
Recent versions introduced changes that break older SSH configs.

Fix: Pin a known working version, for example:
https://github.com/cloudflare/cloudflared/releases/download/2024.12.1/cloudflared-linux-amd64.deb

3. Access policy or hostname mismatch

Double-check in Cloudflare Zero Trust:

• The hostname sshcloudbackend.iem.edu.in still exists
• It is assigned to the correct tunnel
• SSH is allowed in the Access policy
• The policy still allows non-browser connections

Any policy change can trigger handshake failures.

4. SSH multiplexing / keepalive issues

GitHub runners sometimes fail with long-lived SSH connections.

You can stabilize it by adding:
IPQoS none

5. Quick debug step

Add this to see more detail:
ssh -vvv api-vm

or:
cloudflared access ssh --hostname sshcloudbackend.iem.edu.in --loglevel debug