From f04b77198ebdece58577c2ed88adc645c3b90be4 Mon Sep 17 00:00:00 2001
From: WeidiDeng <weidi_deng@icloud.com>
Date: Tue, 21 Apr 2026 17:09:40 +0800
Subject: [PATCH] only clean up connections when stopped

---
 modules/caddyhttp/reverseproxy/streaming.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/caddyhttp/reverseproxy/streaming.go b/modules/caddyhttp/reverseproxy/streaming.go
index d664e66d8..753e1e6cb 100644
--- a/modules/caddyhttp/reverseproxy/streaming.go
+++ b/modules/caddyhttp/reverseproxy/streaming.go
@@ -451,6 +451,7 @@ type tunnelState struct {
 	connections map[io.ReadWriteCloser]openConnection
 	closeTimer  *time.Timer
 	closeDelay  time.Duration
+	stopped     bool
 	mu          sync.Mutex
 	logger      *zap.Logger
 }
@@ -472,7 +473,7 @@ func (ts *tunnelState) registerConnection(conn io.ReadWriteCloser, gracefulClose
 	return func() {
 		ts.mu.Lock()
 		delete(ts.connections, conn)
-		if len(ts.connections) == 0 {
+		if len(ts.connections) == 0 && ts.stopped {
 			unregisterDetachedTunnelStates(ts)
 			if ts.closeTimer != nil {
 				if ts.closeTimer.Stop() {
@@ -490,6 +491,7 @@ func (ts *tunnelState) closeAttachedConnections() error {
 	var err error
 	ts.mu.Lock()
 	defer ts.mu.Unlock()
+	ts.stopped = true
 	for _, oc := range ts.connections {
 		// detached connections are only closed when the upstream is gone from the config
 		if oc.detached {
@@ -654,6 +656,9 @@ func (ts *tunnelState) closeConnectionsForUpstream(addr string) error {
 	var err error
 	ts.mu.Lock()
 	defer ts.mu.Unlock()
+	if !ts.stopped {
+		return nil
+	}
 	for _, oc := range ts.connections {
 		if oc.upstream != addr {
 			continue