hostname -s on the production box is marker-multi-gpu-server-01, and
cron does not set KSKILL_PROXY_DEPLOY_HOST, so the watchdog and
trust-proxy default were no-ops. Accept that hostname, keep the cron
env contract, export the user-bus vars cron needs for systemctl, and
persist the proxy unit as Restart=always.
Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
The 2026-08-29 gpu01 reboot left the public proxy (530) and dashboard
(502) dead for ~10 days. Only the Fastify proxy recovered, because the
deploy cron `restart`s it every run; the tunnel and Loki/Grafana/
Promtail stack used Restart=on-failure, which does not revive a clean
SIGTERM, and nothing else ever started them.
- dashboard systemd units: Restart=on-failure -> always,
StartLimitIntervalSec=0
- commit the previously host-only cloudflared tunnel unit, hardened
with Restart=always, StartLimitIntervalSec=0, and RequiresMountsFor=
on the gpu02:/data NFS paths
- deploy cron: ensure_production_services() starts any watched service
that is installed but inactive, on every run including SHA-noop runs
- document the watchdog and canonical unit locations
Closes#658
Use CF-Connecting-IP when trustProxy hops are set so Tunnel clients are not collapsed into one 429 bucket, retry MOLIT/KRX/building/AirKorea GET 5xx/429/network errors, and accept mcp SDK 2.x in myrealtrip-search.
Co-authored-by: Cursor <cursoragent@cursor.com>
Jeffrey (Dongkyu) Kim