Skip to content
Adventive Adventive Engineering

New Relic Infrastructure agent on tunnel hosts

Status: Accepted, 2026-07-17. Authorized by Jeffrey Lambert. Deviation logged in the repo-root OVERRIDES.md.

Context

Section titled “Context”

The Cloud Connectivity tunnel hosts (adv-cflared) run cloudflared on EC2 behind an Auto Scaling Group, built by AWS EC2 Image Builder on Ubuntu 22.04. The adventive-platform-infra CLAUDE.md §5 sets the standing observability convention for AWS resources: CloudWatch is the default surface, and New Relic data arrives through the account-level New Relic AWS integration, with no per-resource New Relic wiring.

The tunnel is the connectivity backbone between the Cloudflare edge and the private AWS network. The health signal that matters most for it is fast, reliable detection of the cloudflared process dying. The account-level CloudWatch-to-New-Relic path is coarse and higher-latency for that.

Decision

Section titled “Decision”

Install the New Relic Infrastructure agent on the adv-cflared AMI through a new Image Builder component so host metrics and process presence report directly to New Relic as first-class entities. This is a deliberate, scoped deviation from adventive-platform-infra CLAUDE.md §5 for the tunnel-host fleet only. The CloudWatch agent already present in the AMI is retained unchanged.

Consequences

Section titled “Consequences”
  • Native cloudflared process-down detection and sub-minute host metrics, without CloudWatch custom-metric charges.
  • The deviation is scoped to the tunnel-host fleet. The account-level New Relic AWS integration remains the pattern for every other AWS resource.
  • Self-heal behavior is unchanged. The agent runs as an independent newrelic-infra.service and does not alter cloudflared.service, its Restart=on-failure policy, the boot-time bootstrap, or the ASG EC2 health check.
  • The New Relic license key is stored in AWS Secrets Manager (/adventive/newrelic/license-key) and read by the instance role at boot, reusing the existing Secrets Manager credential pattern. No new secret store.
  • The cloudflared Prometheus tunnel-connection scrape (cloudflared_tunnel_ha_connections) is a follow-up: nri-prometheus is Docker/Kubernetes only, so the metric endpoint (already live at 127.0.0.1:2000) will be scraped via nri-flex or the New Relic Prometheus agent in a later revision.

Revert

Section titled “Revert”

Remove the New Relic component from the Image Builder recipe, rebuild the AMI, and roll the ASG. The agent leaves no dependency in the tunnel data path.