fix 502 2

connection_lifetime_test.go

@@ -19,8 +19,17 @@ func TestSSHIdleTimeoutExplicitValue(t *testing.T) {
 	}
 }
 
-func TestNativeXHTTPConnectedIdleSweepDisabled(t *testing.T) {
+// The connected-session sweeper is the backstop that reaps XHTTP->SSH sessions
-	if got := nativeXHTTPIdleTimeout(); got != 0 {
+// whose stream-down GET context never fires (silent client drop behind a CDN).
-		t.Fatalf("native XHTTP idle timeout = %s, want disabled", got)
+// Without it those sessions leak fds/goroutines until a process restart, which
+// is what produced the recurring reboot-only XHTTP 502s. It must stay enabled;
+// the window is generous so only zero-traffic (dead) sessions are reaped.
+func TestNativeXHTTPConnectedIdleSweepEnabled(t *testing.T) {
+	got := nativeXHTTPIdleTimeout()
+	if got <= 0 {
+		t.Fatalf("native XHTTP idle timeout = %s, want a positive backstop window", got)
+	}
+	if got != 20*time.Minute {
+		t.Fatalf("native XHTTP idle timeout = %s, want 20m backstop", got)
 	}
 }

xray_native_tuning.go

@@ -37,12 +37,23 @@ const (
 	// buffers. Operators may request more, up to the hard cap enforced there.
 	defaultNativeXHTTPBufferedPosts = 64
 
-	// Do not impose an application-level lifetime on a connected XHTTP VPN
+	// Backstop reaper for connected XHTTP VPN sessions. The stream-down GET's
-	// session. The official Xray server keeps a connected session for the
+	// request context is the primary lifetime owner, but behind a CDN that context
-	// lifetime of its stream-down GET; request cancellation and I/O errors own
+	// frequently never fires when a client silently drops (mobile networks, CDN
-	// cleanup. A fixed five-minute sweeper incorrectly killed healthy but idle
+	// connection pooling, half-open TCP). When it doesn't, an idle SSH backend
-	// VPNs. Zero disables the connected-session sweeper.
+	// never errors either, so the session, its goroutines, socket/fd, and SSH
-	fixedNativeXHTTPIdleMS = 0
+	// connection leak until the whole process restarts. That accumulation is what
+	// drove the recurring XHTTP 502s that only a reboot cleared: the origin slowly
+	// ran out of fds/memory and could no longer serve new stream-down GETs.
+	//
+	// This sweeper only ever reaps sessions with genuinely stale lastSeen. lastSeen
+	// is refreshed on every successful read OR write via nativeXHTTPConn.onActivity,
+	// so any tunnel still passing data or keepalives is never touched -- only a
+	// session with zero bytes in BOTH directions for the full window (i.e. one that
+	// looks dead) is closed. 20 minutes is generous enough not to disturb a
+	// genuinely idle-but-alive tunnel while still bounding resource growth under
+	// heavy 6-8K-user churn. Zero disables the connected-session sweeper.
+	fixedNativeXHTTPIdleMS = 20 * 60 * 1000
 )
 
 var (