Having trouble deploying projects to cloudstack vm

[arpanbht]

Hey guys I have created a vm inside our cloudstack setup which is having a private ip now i am setting up a github actions runner to deploy our code to the vm and it will auto deploy after that.

For this I am we are using cloudflare tunneling to expose the vm publicly and can ssh into it using cloudflared. Now our deploy yml file is not working...previously it was working and the runner can ssh into the vm but now the setup is failing, its giving bad handshake: 65535 error

Here is our deploy.yml file which we are using to deploy the project into the vm

name: Deploy Node API to cloudbackend.iem.edu.in

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    env:
      CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID }}
      CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Cloudflare Tunnel
        run: |
          curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o cloudflared.deb
          sudo dpkg -i cloudflared.deb

      - name: Setup SSH Key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/api_deploy
          chmod 600 ~/.ssh/api_deploy

      - name: Setup SSH Config
        run: |
          cat <<EOF > ~/.ssh/config
          Host iemcloudbackend
            HostName sshcloudbackend.iem.edu.in
            User ubuntu
            IdentityFile ~/.ssh/api_deploy
            ProxyCommand cloudflared access ssh --hostname %h
          EOF
          chmod 600 ~/.ssh/config

      - name: Test SSH Connection
        run: |
          ssh iemcloudbackend "echo SSH OK"

      - name: Install Node.js (if not present)
        run: |
          ssh iemcloudbackend "
            if ! command -v node &> /dev/null; then
              echo 'Installing Node.js...'
              curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
              sudo apt-get install -y nodejs
            else
              echo 'Node.js already installed'
            fi
            node -v
            npm -v
          "

      - name: Install and Configure Nginx
        run: |
          ssh iemcloudbackend "
            if ! command -v nginx &> /dev/null; then
              sudo apt-get update
              sudo apt-get install -y nginx
              sudo systemctl enable nginx
            fi

            sudo tee /etc/nginx/sites-available/cloudbackend.iem.edu.in > /dev/null <<'NGINX_CONF'
            server {
              listen 80;
              server_name cloudbackend.iem.edu.in;

              location / {
                proxy_pass http://127.0.0.1:8000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade \$http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host \$host;
                proxy_set_header X-Real-IP \$remote_addr;
                proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto \$scheme;
                proxy_read_timeout 300s;
                proxy_connect_timeout 300s;
              }
            }
            NGINX_CONF

            sudo ln -sf /etc/nginx/sites-available/cloudbackend.iem.edu.in /etc/nginx/sites-enabled/
            sudo rm -f /etc/nginx/sites-enabled/default
            sudo nginx -t && sudo systemctl reload nginx
          "

      - name: Create App Directory
        run: |
          ssh iemcloudbackend "sudo mkdir -p /var/www/api && sudo chown -R root:root /var/www/api"

      - name: Deploy Backend Code
        run: |
          rsync -avz --delete \
            --exclude=node_modules \
            --exclude=.git \
            -e "ssh" \
            ./ iemcloudbackend:/var/www/api/

      - name: Install Dependencies
        run: |
          ssh iemcloudbackend "
            cd /var/www/api
            npm ci
          "

      - name: Restart Node Server (sudo)
        run: |
          ssh iemcloudbackend "
            cd /var/www/api

            echo '🚀 Starting server...'
            nohup sudo node src/server.js \
              > /var/log/api-server.log 2>&1 &

            sleep 3
          "

      - name: Verify Server
        run: |
          ssh iemcloudbackend "
            echo '🔍 Checking process...'
            pgrep -f 'node src/server.js' || exit 1

            echo '🔍 Checking port 8000...'
            ss -lntp | grep ':8000' || exit 1

            echo '📄 Logs:'
            tail -20 /var/log/api-server.log
          "

      - name: Health Check
        run: |
          ssh iemcloudbackend "
            echo '⏳ Waiting for server to warm up...'
            sleep 5

            for i in {1..5}; do
              if curl -f http://127.0.0.1:8000/ > /dev/null; then
                echo '✅ Health check passed (local)'
                exit 0
              fi
              echo \"Retry \$i...\"
              sleep 3
            done

            echo '❌ Health check failed'
            exit 1
          "

      - name: Done
        run: |
          echo "🎉 Deployment complete!"

[prashanthr2]

@arpanbht Based on what you described I don't see it as a cloudstack issue. A "handshake" error confirms that the network path exists but the security negotiation is being rejected at the Cloudflare edge. Also, a quick search on the error (its giving bad handshake: 65535 error) tells me its more likely a cloudflare tunnel issue.

Saying that I am not sure if this is the right discussions forum for your issue may be you can try cloudflare or github discussions if any ( unless someone else here as some additional inputs on this)

[arpanbht]

ok man, thanks for your feedback 👏