ImpulseSecrets
Troubleshooting
The common symptoms across install, provisioning, access, custom domains, BYOK, and lifecycle — and exactly where in the addon to look and fix them.
1. Install & registration
Section titled “1. Install & registration”| Symptom | Where to look / fix |
|---|---|
| Dashboard shows “Core: Not registered” | Ensure ImpulseCore is active, then deactivate and reactivate ImpulseSecrets to re-run registration from the manifest |
| Activation errors after a Core update | Make sure ImpulseCore is at 1.61.13 or later and active first; an older ImpulseCore refuses the registration |
| Premium features dark | Diagnostics → License: check the key prefix (ISEC-), its status, and the grace state. The key is entered in ImpulseCore → Modules & Licensing → Licenses. If you moved WHMCS, update its domain under Change domain on the license in the Impulse Software portal (for a new server IP, contact support), then click Re-check now under ImpulseCore → Modules & Licensing → Licenses. |
| Cron tasks not listed | Confirm ImpulseCore’s master cron entry is installed; ImpulseSecrets adds no crontab line of its own and runs entirely through Core’s runner |
2. Provisioning
Section titled “2. Provisioning”| Symptom | Where to look / fix |
|---|---|
| Shared Create fails “no capacity” | Register an active shared server with free capacity in the target region and matching the plan’s engine, then retry Create. Provisioning refuses an engine mismatch |
| Dedicated box stuck provisioning | Check that the provision cron (every 2 min) is running. The box is retained for debugging, never auto-destroyed on timeout |
| Service won’t reach active | Open Diagnostics → Health Checks and the service row under Customers; confirm the Admin Proxy is reachable and the box’s certificate has issued |
| BYOK order stays Pending | The customer’s KMS key hasn’t validated yet, or the provider can’t be used on the plan’s engine — see Customer-managed keys |
3. Access & usage
Section titled “3. Access & usage”| Symptom | Where to look / fix |
|---|---|
| Usage tab empty | Expected until the first 15-minute metering cycle. Run Sync Usage Now from the WHMCS service page to force a snapshot |
| Customer “saved a secret but can’t see it” | They are viewing a different path — or, on Infisical, a different environment. Switch the selector to match |
| Automation can’t authenticate | Use a machine identity access token, not a personal login (on Infisical services, from the Access tab); confirm it is current and scoped |
| Org mapping looks wrong | Run Rebuild Org from the service page to re-create/repair the customer organization mapping |
4. Custom domains, BYOK & TLS
Section titled “4. Custom domains, BYOK & TLS”| Symptom | Where to look / fix |
|---|---|
| Custom domain not going active | Confirm the customer created the exact CNAME shown on the Domains tab. domain_polling re-checks Cloudflare DNS/SSL every 5 minutes |
| BYOK validation fails | Confirm the credential payload grants the operations the validator runs on the key (encrypt/decrypt, or wrap/unwrap on Azure Key Vault). PKCS#11 HSM validates shape only and fails closed |
| Sudden BYOK decryption failure | Treat it as a customer-side KMS policy change first — check whether they revoked or rotated key access. Failing closed is by design |
| TLS certificate looks wrong | Check the TLS certificates panel under Diagnostics → Health Checks: it shows the live certificate’s issuer, expiry, and SANs. Reissue so the live certificate’s SANs cover the server’s hostname — an apex wildcard does not cover a deeper hostname |
5. Lifecycle & recovery
Section titled “5. Lifecycle & recovery”| Symptom | Where to look / fix |
|---|---|
| Suspend/Unsuspend didn’t change access | Shared drops the project member / disables the tenant; dedicated/BYOK stop the engine on the server through the Admin Proxy, with the service row fenced too in case the server can’t be reached. Re-run the WHMCS action and check Diagnostics → Activity for the audit entry |
| Migration stalled | The migration cron (5 min) advances jobs through provisioning → replicating → validating → cutover_pending; a cutover-pending job waits for the final cutover from the service Overview. Jobs checkpoint, so a retry resumes |
| Need to detach a broken service | Use Detach From Core on the service page to remove the ImpulseCore project attachment for recovery/cleanup |
| A service disappeared | Check its WHMCS status and Diagnostics → Activity: a suspended or terminated service is deleted when its 7-day grace window ends. The daily free-tier inactivity check only logs free-plan services with no recent usage — it never suspends or deletes anything |