Hotfix: the weekly Cloudflare RemoteIP refresh deleted its own Apache config every Monday. /etc/cron.d files do not inherit PATH from /etc/crontab, so apache2ctl and the a2* helpers (all in /usr/sbin) were unreachable under cron; the script read that as its own config being invalid and removed it, leaving a dangling symlink. After the next Apache reload mod_remoteip went inert, every tunnelled request appeared to come from 127.0.0.1, and because fail2ban's ignoreip covers 127.0.0.1/8 that made all tunnelled traffic invisible to every jail. The script now sets PATH itself, verifies its tools before writing anything, checks install's exit status, and no longer assumes a failing configtest is its own fault. Recommended for every install behind a Cloudflare Tunnel.