sulthan
15382eb603
Compose merges `networks:` across override files rather than replacing them,
so the prod override's claim that it must re-name every network was false —
and the rationale built on it ("proxy carries the poller's egress") was false
too. Verified against `docker compose config`: the API renders on db, default
and proxy with only `proxy` named here. Egress comes from `default`, which is
now the thing a maintainer must not tidy away.
chrome/.env.example shipped BROWSER_BIND_ADDR=100.x.y.z as a live value, so
`cp .env.example .env && docker compose up` failed with Docker rejecting an
invalid IP instead of the guard message both troubleshooting tables promise.
Commented out, so the promised message is what you actually get.
DEPLOY §7 gains the two steps that were asserted but never instructed: a
Tailscale ACL, without which "Tailscale identity is the access control" is
aspirational and 9222 is open to every device on the tailnet; and a VPS
`free -m` reading before and after, without which the memory this move
reclaims cannot be shown.
Also drops a change-narration comment and three restatements of measured facts
that already have a canonical home.
63 lines
2.9 KiB
YAML
63 lines
2.9 KiB
YAML
# The browser, as its own deployable unit.
|
|
#
|
|
# This does NOT run beside the API. It runs on the home machine, reached from
|
|
# the VPS over the tailnet, and is updated without touching the API stack:
|
|
#
|
|
# cd chrome && docker compose up -d --build
|
|
#
|
|
# Set BROWSER_BIND_ADDR in chrome/.env to this machine's tailnet IP. See
|
|
# ../DEPLOY.md §7 for the full first-time procedure and ../docs/adr/
|
|
# 0006-browser-on-the-home-machine.md for why the browser lives here at all.
|
|
name: bookmark-browser
|
|
|
|
services:
|
|
browser:
|
|
build: .
|
|
image: bookmarkmanager-chrome:latest
|
|
container_name: bookmark-browser
|
|
restart: unless-stopped
|
|
environment:
|
|
# Any real zone works, but a UTC clock is itself the bot signal and the
|
|
# challenge then never clears — measurement in entrypoint.sh. Unset falls
|
|
# back to the host's /etc/timezone below, which is a real zone whenever
|
|
# the host clock is local; set BROWSER_TZ when the host runs UTC.
|
|
TZ: ${BROWSER_TZ:-}
|
|
volumes:
|
|
# The zone *name*, which is what Chrome's ICU needs — see entrypoint.sh.
|
|
# Absent on a non-Debian host, which the entrypoint handles by falling back to UTC.
|
|
- /etc/timezone:/etc/timezone:ro
|
|
# Cloudflare clearance must survive Chrome reaping and image recreation.
|
|
- chrome-profile:/home/chrome/profile
|
|
# Bound to the tailnet address only, never 0.0.0.0. CDP authenticates
|
|
# nothing: whatever reaches this port drives the browser and, through it,
|
|
# this host. On the VPS the safety was Docker network membership; here the
|
|
# machine has a real LAN, so the bind address *is* the access control,
|
|
# backed by Tailscale device identity. No default — an unset variable must
|
|
# fail the deploy rather than silently publish CDP to the LAN.
|
|
ports:
|
|
- "${BROWSER_BIND_ADDR:?set BROWSER_BIND_ADDR to this machine's tailnet IP}:9222:9222"
|
|
# Reaps zombie renderer processes, which otherwise accumulate for the
|
|
# container's lifetime.
|
|
init: true
|
|
# Chrome allocates shared memory per tab and dies on Docker's 64MB default.
|
|
# 128MB against a measured 19MB peak: the old 1GB reservation was sized by
|
|
# superstition, and this box has 1.8GB total.
|
|
shm_size: '128mb'
|
|
# The browser is the newcomer on a machine where a Gitea runner already
|
|
# holds ~1.2GiB of 1.8GiB. Load-bearing, not decorative: untuned Chrome
|
|
# peaked at 645MiB cgroup, which is more than is free here.
|
|
#
|
|
# memswap_limit is memory+swap combined, so this allows 512MiB of swap —
|
|
# Chrome reclaims its own cold pages onto this box's 5.9GiB of SATA swap
|
|
# instead of taking resident memory from the runner.
|
|
mem_limit: 512m
|
|
memswap_limit: 1g
|
|
# If the box does run out, the kernel takes the browser and never CI.
|
|
oom_score_adj: 800
|
|
# A challenge solve yields to a running build. Cold start degrades to ~3s
|
|
# at half a CPU, immaterial against a 45-second challenge budget.
|
|
cpu_shares: 512
|
|
|
|
volumes:
|
|
chrome-profile:
|