Diagnose CDN origin server reachability and back-to-source failures using hcloud CLI. Query the origin configuration (origin_addr, origin_type, http_port, https_port, origin_protocol) of a CDN domain via ShowDomainFullConfig/v2, then probe origin server connectivity using the Python probe script (scripts/origin_probe.py) to identify the root cause of back-to-source failures, origin unreachable errors, and abnormal responses. Use when the user wants to: (1) diagnose CDN back-to-source failures, (2) check why origin server is unreachable, (3) troubleshoot origin configuration issues, (4) verify origin connectivity from the network perspective, (5) investigate abnormal HTTP responses from the origin. Triggers include: '源站诊断', '源站不可达', '回源失败', 'origin diagnosis', 'origin unreachable', '回源异常', '源站配置' Do NOT use this skill for configuration changes, cache refresh/preheat, domain lifecycle management, or billing operations — this skill is strictly read-only diagnosis.
This skill is used to diagnose CDN back-to-source failures, origin unreachable errors, and other origin-related issues. It queries the CDN domain's origin configuration (origin address,
origin type, back-to-source port, back-to-source protocol) via hcloud CLI, and probes origin server connectivity using the Python probe script (scripts/origin_probe.py), helping users
identify the root cause of back-to-source failures, such as abnormal origin server services, closed ports, or CDN back-to-source IP ranges not whitelisted.
Key Features:
Automatically queries and parses CDN origin configuration (configs.sources)
Supports connectivity probing for all three back-to-source protocols: http / https / follow
If a user requests a prohibited operation, you must refuse and inform:
"Per security constraints, this skill does not allow write/delete/modify operations. This skill is for origin connectivity diagnosis only. Please use the Huawei Cloud CDN console or run
hcloud CLI manually for configuration changes. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."
Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required
Run hcloud version to verify the version. If not installed or the version is too low, see references/cli-installation-guide.md.
bash
hcloud version
Prerequisite check: Python >= 3.8 required
Python is used for the origin connectivity probe script (scripts/origin_probe.py).
bash
python --version
Prerequisite check: Python library requests >= 2.25 available
The scripts/origin_probe.py probe depends on the requests library.
CDN APIs only support two regions: cn-north-1 (Beijing) and ap-southeast-1 (Singapore).
Query results are region-independent (CDN is a global service).
Recommended: use cn-north-1.
Prohibited from reading, echoing, or printing AK/SK values
Prohibited from asking the user to input AK/SK directly in the conversation
Prohibited from using hcloud configure set to pass plaintext credentials
Prohibited from accepting AK/SK directly provided by the user in the conversation
Only allowed to read credentials from environment variables or configured CLI config files
Important: Handling user-provided credentials
If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
Stop immediately - Do not execute any commands
Politely refuse and return the following message:
text
For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.
Please use one of the following secure methods to configure credentials:
Method 1: Interactive configuration (recommended)
hcloud configure
# Enter AK/SK as prompted; credentials will be securely stored in a local config file
Method 2: Environment variable configuration
export HUAWEICLOUD_SDK_AK=<your-access-key-id>
export HUAWEICLOUD_SDK_SK=<your-secret-key>
After configuration is complete, please retry your request.
Do not continue executing any Huawei Cloud operations until credentials are configured
Check CLI configuration:
sh
hcloud configure list
Check whether the output contains valid configuration (AK/SK, IAM, etc.).
scripts/origin_probe.py emits a single JSON object on stdout wrapped in {result, data, error_msg} (fields inside data: scheme, host, port, connected, http_status,
is_private_address, duration_ms, error)
The probe protocol is selected based on origin_protocol (http / https / follow)
Parameter Confirmation
Before executing the diagnosis, confirm the following parameters with the user:
Parameter
Required
Description
Default
Example
domain_name
Yes
CDN accelerated domain to diagnose
None
www.example.com
--cli-region
Yes
Huawei Cloud region
cn-north-1
cn-north-1
User Confirmation Checklist:
Target domain provided
User understands this is a read-only diagnosis operation
User understands that probe commands have a 10-second timeout
User understands that probes send HTTP/HTTPS requests to the origin server (HEAD preferred, GET fallback on 405; read-only, no side effects)
Core Workflows
Target domain is required before any diagnosis step.
If the user did not provide a target domain, ask the user for the domain name and wait for the reply before starting.
Only if the user does not know the domain or asks you to look it up, list the account's domains via hcloud CDN ListDomains/v2 and ask the user to choose one.
Never start the diagnosis without an explicit user-provided domain: do not guess a domain, do not fall back to an example/default domain, and do not pick a domain from the list yourself.
Step 1: Credential Check and Domain Permission Validation
Check hcloud credential availability, and validate that the domain belongs to the current account via ShowDomainDetailByName.
Select the probe protocol based on origin_protocol, and probe origin server connectivity via scripts/origin_probe.py, parsing the JSON output inside the {result, data, error_msg}
envelope (data.http_status, data.connected, data.is_private_address, data.error).
Q1: What should I do when "Credentials not configured" is reported?
A: Run hcloud configure to configure AK/SK interactively, or set the environment variables HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK, then verify with hcloud configure list.
Q2: ShowDomainDetailByName returns 404 / CDN.0171?
A: The domain does not exist or does not belong to the current account. Check the domain spelling and account ownership; use hcloud CDN ListDomains/v2 --cli-region=<region> --page_size=100
to list onboarded domains.
Q3: 403 insufficient permissions?
A: Ensure the IAM user has the CDN query permission (cdn:*:query*, plus cdn:configuration:queryDomains); contact the primary account administrator to grant them. See
references/iam-policies.md for details.
Q4: Probe timeout (error.reason=connect_timeout)?
A: Return partial results and note "Origin probe timed out. Manual verification recommended."; check local network connectivity, the origin address/port, and whether the origin firewall
allows CDN back-to-source IP ranges.
Q5: connect_failed / tls_handshake_failed?
A: connect_failed = connection refused / network unreachable / DNS resolution failure; tls_handshake_failed = TCP reachable but HTTPS certificate abnormal (the script never bypasses
certificate validation). Both are handled as "origin unreachable" with an IP whitelist prompt.
Q7: Origin configuration query shows empty sources?
A: Report "Origin not configured", skip the probe step, and prompt the user to
configure the origin in the CDN console.
Known Limitations:
CDN APIs only support two regions: cn-north-1 and ap-southeast-1
Probe results reflect the execution environment's network perspective only, not the CDN edge node's back-to-source path
With origin_protocol=follow, both http and https must be probed
Error Code Quick Reference:
Error Code
Meaning
Handling
401
Invalid or expired AK/SK
Reconfigure credentials
403
Insufficient permissions
Grant cdn:*:query* (+ cdn:configuration:queryDomains)
404 / CDN.0171
Domain does not exist or not owned by the current account
Confirm domain ownership
connect_timeout
TCP connect exceeded the 10s budget
Check network / firewall / origin address and port
connect_failed
Connection refused / network unreachable / DNS resolution failure
Abort the probe; prompt to install requests>=2.25 per cli-installation-guide.md
Self-check before output: Before emitting the diagnosis report, verify it contains the 6 mandatory blocks (analysis time / target domain / origin configuration / diagnosis items /
conclusion / remediation suggestion); complete any missing block before output (see references/acceptance-criteria.md).
Failure propagation: When any preceding step (Step 1-3) fails and aborts, mark subsequent steps as N/A (do not execute), set the report Conclusion status to "Cannot Diagnose", and
provide a clear next action (authorization / credential configuration / manual verification, etc.).
Output Format
Probe JSON output (scripts/origin_probe.py): A single JSON object on stdout, wrapped in the {result, data, error_msg} envelope; business fields are inside data:
Field
Type
Required
Description
result
string
Yes
Enum: success / failed
data.scheme
string
Yes
http / https
data.host
string
Yes
Origin host (IP literal or domain)
data.port
integer
Yes
Origin port (1-65535)
data.connected
boolean
Yes
Whether an HTTP response was received
data.http_status
integer | null
Yes
HTTP status code; null when no response
data.is_private_address
boolean
Yes
Whether the origin is a private / loopback / link-local address
Diagnosis report template: The full template (separator line ====, section headers --- xxx ---, diagnosis item list, conclusion and remediation suggestion, IP whitelist prompt rules)
and example reports are defined in references/task-report-generation.md.
Prohibited content: The report and any output must NEVER include AK/SK, account credentials, or other sensitive information; must NOT fabricate probe data — reflect the data.* fields truthfully.
