---
name: cloudflared-tunnel-restart-gotchas
description: "When restarting the user-config cloudflared tunnel in tmux (the omidlab one), avoid two specific mistakes that took the site down twice in one session"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: cd07777c-8add-4afc-9cb9-9113caa0331f
---

When restarting the **omidlab cloudflared tunnel** (the one in `agents:cf-omidlab` tmux, config `~/.cloudflared/config.yml`, tunnel `350655a2-…`), AVOID these two specific moves — both took the site down for ~30s during the 2026-06-09 wandb-self-host work:

1. **Don't `kill -HUP` cloudflared expecting a config reload.** Cloudflared treats SIGHUP as a terminate signal, not "reload config." It just exits. To pick up new ingress rules in `config.yml`, you have to restart the process.

2. **Don't launch cloudflared via `bash -c 'exec cloudflared …'` in `tmux new-window`.** With `exec`, the bash shell IS the cloudflared process — when you `kill <pid>` it, the entire tmux pane (and thus the window) dies. Then `tmux send-keys -t agents:cf-omidlab …` to relaunch fails ("can't find window"). Site stays down until you `tmux new-window` again from scratch.

**Why:** Both mistakes happened in the same session while iterating on a wandb-local subdomain ingress rule. Each one cost ~30 sec of site outage.

**How to apply:** the right restart pattern for the omidlab cloudflared tunnel:
1. Launch it WITHOUT `exec`: `tmux new-window -t agents -n cf-omidlab -d 'cd /home/cameronsmith && cloudflared tunnel run 350655a2-4ba4-4a88-beb5-405192dcbff3 2>&1 | tee /tmp/cf-omidlab.log'` (no `exec`, so bash stays around).
2. To restart in place: `tmux send-keys -t agents:cf-omidlab C-c` then `tmux send-keys -t agents:cf-omidlab -l "<same launch cmd>"` + Enter. The window survives because bash is the parent.
3. Alternatively for one-shot bounce: `pkill -f "cloudflared tunnel run 350655"` + relaunch in window via send-keys.

Reference: [[wandb-selfhost-attempted-2026-06-09]] is the session where both gotchas surfaced.