sulthan
15382eb603
Compose merges `networks:` across override files rather than replacing them,
so the prod override's claim that it must re-name every network was false —
and the rationale built on it ("proxy carries the poller's egress") was false
too. Verified against `docker compose config`: the API renders on db, default
and proxy with only `proxy` named here. Egress comes from `default`, which is
now the thing a maintainer must not tidy away.
chrome/.env.example shipped BROWSER_BIND_ADDR=100.x.y.z as a live value, so
`cp .env.example .env && docker compose up` failed with Docker rejecting an
invalid IP instead of the guard message both troubleshooting tables promise.
Commented out, so the promised message is what you actually get.
DEPLOY §7 gains the two steps that were asserted but never instructed: a
Tailscale ACL, without which "Tailscale identity is the access control" is
aspirational and 9222 is open to every device on the tailnet; and a VPS
`free -m` reading before and after, without which the memory this move
reclaims cannot be shown.
Also drops a change-narration comment and three restatements of measured facts
that already have a canonical home.
29 lines
1.4 KiB
Bash
29 lines
1.4 KiB
Bash
# Copy to chrome/.env on the home machine. Never commit the real .env.
|
|
#
|
|
# This file configures the browser unit only. It is separate from the API
|
|
# stack's ../.env on purpose: the two run on different machines.
|
|
|
|
# The address the CDP port is published on — required, no default.
|
|
#
|
|
# Use this machine's **tailnet IP**, e.g. 100.x.y.z (`tailscale ip -4`). Not
|
|
# 0.0.0.0, not the LAN address: CDP has no authentication of its own, so
|
|
# anything that can reach this port has full control of the browser and a
|
|
# foothold on this host. Tailscale device identity plus an ACL is the access
|
|
# control; the bind address is what enforces it.
|
|
#
|
|
# For a throwaway local test, 127.0.0.1 is fine — but then only this machine
|
|
# can reach it, so the API must run here too.
|
|
# Left commented so `cp .env.example .env && docker compose up` fails with the
|
|
# variable's own message telling you what to set, rather than Docker rejecting
|
|
# "100.x.y.z" as an invalid IP.
|
|
# BROWSER_BIND_ADDR=100.x.y.z
|
|
|
|
# Clock zone the browser reports. Any real zone works and it need not match
|
|
# the egress IP's country — but it must not be UTC, which is itself the bot
|
|
# signal that stops the challenge clearing. The measurement is in entrypoint.sh.
|
|
#
|
|
# Unset falls back to the host's /etc/timezone, which is a real zone whenever
|
|
# the host clock is set to local time. Set this when the host runs UTC — a UTC
|
|
# server is exactly the case that fails.
|
|
# BROWSER_TZ=Asia/Jakarta
|