The Tunnel That Never Crashed, So systemd Never Restarted It
Friends kept getting "Timed out" on my game server. The server was fine. The tunnel agent was stuck retrying forever, which looked healthy to systemd.
Friends would get kicked from my Minecraft server with "Timed out," sometimes for hours. The obvious suspects were the server and its Wi-Fi link. The real cause was only in one place: the journal of the playit tunnel agent, which logged "control session expired" between 2 and 7 times a day normally, and 725 times on a bad day.
The service was already set to Restart=always, and it had never restarted once. The agent doesn't exit when it loses its control session. It retries internally, forever. To systemd it was a healthy, running process, so the restart policy I'd been counting on could never fire during an outage.
The fix was a small watchdog on a five-minute timer. It counts control-session failures in the last ten minutes of the journal and restarts the agent when there are more than ten. It has a 30-minute cooldown and won't touch an agent that started less than five minutes ago. The threshold is deliberately an order of magnitude above the normal rate, because a restart kicks everyone connected through the public address.
At home everyone now joins over the LAN entry, which skips the tunnel entirely. The general lesson: "restart on failure" only helps if the failure actually ends the process. Check what your service does when it's stuck, not just when it crashes.