Lab #4238: artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Summary

A user in Spain on Vodafone home broadband couldn't reach https://artifacts.swamp-club.com/install.sh. HTTPS connections, including openssl s_client -connect artifacts.swamp-club.com:443, hung. Over plain HTTP, Vodafone returned its own block page: "Por causas ajenas a Vodafone, esta web no está disponible" ("For reasons outside Vodafone's control, this website isn't available").

The cause is the Spanish court ruling won by LaLiga. It lets ISPs (Vodafone, Movistar, Orange, DIGI and others) block Cloudflare IP ranges during football matches to stop illegal streams. Because Cloudflare IPs are shared, every site behind those addresses becomes unreachable for those ISPs' customers while a match is on. That includes our install script, so curl … | sh installs fail in Spain at those times.

Steps to reproduce

From a Spanish residential ISP (Vodafone confirmed) during a LaLiga match, run curl -fsSL https://artifacts.swamp-club.com/install.sh.
The HTTPS connection hangs. Plain http:// returns the ISP block page.

What we ruled out

IPv6: artifacts.swamp-club.com has AAAA records ([IP-1], [IP-2]). install.sh returns HTTP 200 over IPv6 from four Globalping probes in DE, FI and FR.
General outage: the script loads fine elsewhere, including over IPv4 (HTTP 200, 23,001 bytes).
Corporate firewall: this was a home network on a personal machine.

Impact

Installs and upgrades fail during matches for users on most large Spanish ISPs, which covers most residential connections in Spain.
It's intermittent and looks like a swamp outage to the user. There's no error from us, just a hang.
The current workaround is a VPN.

Possible fixes (to discuss)

Fallback host off Cloudflare: serve install.sh and release binaries from a second origin that isn't on shared Cloudflare IPs, for example the storage bucket directly or a GCP load balancer with its own IP. Have install.sh try that host when the primary one fails.
Document the workaround: add a troubleshooting note covering the Spain blocks, with a direct download URL that avoids Cloudflare.
Dedicated or BYOIP addresses on Cloudflare (Enterprise). This lowers the risk but may not avoid blocks that target whole ranges.
Multi-CDN or DNS failover for artifacts., so it can be steered away from Cloudflare when a block is detected.

References

The blocks are widely reported as "LaLiga Cloudflare blocking Spain". There are also public trackers showing when blocks are active, such as hayahora.futbol.

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Failed remote methods lose named command-result output handles at Serve

Whole run-index rewrites block serve dispatch as retained inputs grow

Worker control WebSocket reports Frame too large and aborts small native dispatches

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

cfgmgmt firewall: match rules by destination and comment

Align Caddy reverse-proxy TLS documentation with Kubernetes proxy guidance

Scheduled flaky-test detection is failing

vault put --server: accept the value on stdin (keep secrets out of argv)

swamp serve exhausts its heap when a workflow's run history carries large inputs: every run save parses and rewrites the whole .runs-index.json

Hot reload can keep an old local behavior registry and memoized bundle after external catalog indexing (1602; e459 regression passes)

Add expiring service-account token requests and authorization checks to RBAC

Flaky: v3 replica check stall test reads restore.pid before the stub writes it

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

verify-build upgrade gate silently skips models whose version is a constant

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

Docs: document the datastore durable setting and its macOS ordering in the manual

Docs: working offline against swamp serve (leases, outbox, flush, quarantine) for swamp-club#4195

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

Docs: swamp data query --sort, --cursor and nextCursor in the data reference

A malformed --ca-cert file is reported as an unreadable OS certificate store

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache

Read-model catch-up of many data versions slows sharply under load

swamp serve --groups-field help says group/collective memberships; it names only the collectives field

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

A step settled after the abort overwrites the expression-context entry of a same-named step that ran in another job

The extractContentMetadata property test generates invalid source and fails at random

A limited model.output.search copies and sorts the whole listing on the event loop for each request, so that step still scales with the window

Flaky test: access_poll_phase_telemetry_test sees grants_active 1 where the snapshot build read 2 records

A lone step in a job still starts under the aborted signal when another job has suspended the run

CLI command to change an existing extension's visibility (private → public)

Docs: team-mode model leases (swamp behavior lease, lease status in datastore lock status)

serve (token mode): --admins accepts idp-group entries that can never match

build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing

Filesystem control-plane put races empty-parent cleanup (cron pending-run ENOENT)

deployment: getLogs method (deployment-aware pod log tailing)

Agent sessions extension: import Codex sessions

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

Docs: v3 serve team mode, followers forward writes and the advertise-address and ca-cert serve flags (swamp-club#4120)

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

swamp inbox: with a filter active, sitting on the last row pages through the whole inbox in the background

@swamp/video/brand: follow-ups from the initial review (render hang, odd sizes, Chromium errors)

Relationships

#4238 artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)