5 days ago
Project: BatchBot (ecf90384-48b5-4e08-8b24-21e9d0ba8bfa), service batchbotbeta1.0 (961eedaa-0d61-49f9-8d37-59139aee8255), production, region sfo, single replica.
Custom domains (Cloudflare-proxied): batchbot.io → 41au322s.up.railway.app, www → cbtn9qmj.up.railway.app.
For at least the past 2 days, Cloudflare has been intermittently failing to reach my Railway origin. Cloudflare zone analytics show (UTC):
2026-07-02 06:00–07:00: 78 × 502 (example Ray ID: a14b8f78af87a38d, 06:23:22 UTC)
Ongoing scatter the same day: 4×530 (08:00), 1×502 (09:00), 5×502 (10:00), 2×502 (14:00), 8×522 (15:00), plus 525 TLS-handshake failures and 520s on 2026-07-01.
On 2026-07-02 ~08:20 UTC I measured TTFB to /api/health (a static JSON endpoint): 0.12–0.17s hitting batchbotbeta10-production.up.railway.app directly, but 0.4–9.4s via the proxied domain, fluctuating round to round.
During all of these windows my origin was demonstrably healthy: Railway HTTP logs show zero 5xx served, deploy logs show no restarts/OOM, CPU was ~1% of limit, and an in-app event-loop-lag monitor logged no stalls ≥500ms. The failures (502 bad gateway, 522 connect timeout, 525 TLS handshake) all occur before requests reach my container.
Could you check the health of the sfo ingress/edge for my domains during those windows, and whether there are known issues on the Cloudflare→Railway path? Happy to provide more Ray IDs or run tests on request.
(Cloudflare SSL mode is Full (strict) — verified before filing.)
1 Replies
5 days ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • 5 days ago
4 days ago
that's 100% the cloudflare proxy, not railway. your own numbers show it, railway served zero 5zz and direct ttfb is fine, so everything's dying on the hop between cloudflare and railway. that combo just does this, cloudflare reuses connections to railway's edge, railway drops them, you get random 502s and 522s while both sides look healthy.
flip both records to dns only and it stops. railway has its own cert so you lose nothing unless you actually need cloudflare's waf or caching. if you do need the proxy there's no setting that fixes it, it's just like that.