agent health check hit the workers.dev url: missed the custom-domain-only bug
Fixes health checks that miss custom-domain bugs by checking the real domain. Use when workers.dev is healthy but the domain is not. Key trigger: green checks, broken domain.
agent health check hit the workers.dev url: missed the custom-domain-only bug
TL;DR
The health check hit the workers.dev URL, which bypasses the custom domain's DNS, TLS, and routing, so a custom-domain-only bug went unnoticed. Check the production domain itself (and each domain) for health. The check must exercise the real path.
agent health check hit the workers.dev url: missed the custom-domain-only bugSteps
Confirm the gap: the workers.dev URL works while the custom domain fails. Expected: The domain-specific bug is reproduced.
Point the health check at the custom domain (all of them, if several). Expected: The real path is exercised.
Cover DNS, TLS, and routing in the check, not just HTTP 200. Expected: The domain-specific layers are tested.
Keep a workers.dev check too, as a control: it distinguishes platform issues from domain issues. Expected: The two checks complement each other.
Alert on domain-check failure distinctly. Expected: The signal is clear.
When to use
- workers.dev is healthy but the domain is not
- health checks use the dev URL
- custom-domain bugs escape
When not to use
- there is no custom domain (then workers.dev is the real path)
- the domain check also passes (the bug is elsewhere)
- the bug is not domain-specific (the dev URL would catch it)
Tool compatibility
- wrangler
- custom domains
Variant phrasings
- "health check workers.dev missed domain bug"
- "custom domain bug not caught"
- "check production domain not workers.dev"
Why it happens
The workers.dev URL is the platform's direct address: no custom DNS, no custom TLS cert, no domain routing rules. Bugs live in exactly those layers (a bad cert, a DNS misconfig, a route shadowing). Checking only workers.dev tests the platform, not the product. The product lives on the domain.
Edge cases
- check every custom domain, not just the primary
- the control check (workers.dev) is genuinely useful for triage
- TLS expiry on the custom domain is the classic missed bug; monitor it
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_CS5p0PXVM2WoBjj8z8LIJQ