sulthan
e4a313e626
The headless browser leaves the API stack. It becomes its own compose unit
(chrome/docker-compose.yml) deployed on the home machine and reached over the
tailnet, returning 471 MiB of working set to a 1974 MiB VPS that has no swap.
No fallback sidecar is left behind.
The backend needs no code change: BROWSER_WS_URL was already the only coupling,
so relocation is one environment variable. Its default is now empty rather than
a pinned Docker IP — an unreachable or unconfigured browser degrades exactly as
it always has, with plain-TLS libraries unaffected, kagane and novelfull logged
and skipped, and stored covers still served.
The browser unit publishes CDP on ${BROWSER_BIND_ADDR} with no default, because
CDP authenticates nothing and the home machine has a real LAN: an unset value
must fail the deploy rather than silently expose an endpoint that is remote code
execution for anything that reaches it. Resource limits are sized against the
measured 645 MiB untuned peak and the CI runner that already holds 1.2 GiB of
that box.
bookmark-api gains the default network. Dropping `browser` left it on `db`
alone, which is internal: true — that meant no published port and, worse, no
egress for the poller at all. Caught by bringing the stack up.
Docs: ADR-0006 for the topology, DEPLOY.md §7 for first-time setup of the
browser machine, REDEPLOY.md §8 for its independent update cadence, plus the
architecture diagrams, config tables and troubleshooting rows.
29 lines
1.4 KiB
Bash
29 lines
1.4 KiB
Bash
# Copy to chrome/.env on the home machine. Never commit the real .env.
|
|
#
|
|
# This file configures the browser unit only. It is separate from the API
|
|
# stack's ../.env on purpose: the two run on different machines.
|
|
|
|
# The address the CDP port is published on — required, no default.
|
|
#
|
|
# Use this machine's **tailnet IP**, e.g. 100.x.y.z (`tailscale ip -4`). Not
|
|
# 0.0.0.0, not the LAN address: CDP has no authentication of its own, so
|
|
# anything that can reach this port has full control of the browser and a
|
|
# foothold on this host. Tailscale device identity plus an ACL is the access
|
|
# control; the bind address is what enforces it.
|
|
#
|
|
# For a throwaway local test, 127.0.0.1 is fine — but then only this machine
|
|
# can reach it, so the API must run here too.
|
|
BROWSER_BIND_ADDR=100.x.y.z
|
|
|
|
# Clock zone the browser reports. A UTC clock is itself the bot signal —
|
|
# Cloudflare treats it as the datacenter default — and kagane's challenge then
|
|
# never clears. Measured 2026-08-08, identical container, one Indonesian egress
|
|
# IP: UTC never cleared in 60s (twice); Asia/Jakarta and America/New_York both
|
|
# cleared in 4s. So any real zone works; it does not have to match the IP's
|
|
# country, it just must not be UTC.
|
|
#
|
|
# Unset falls back to the host's /etc/timezone, which is a real zone whenever
|
|
# the host clock is set to local time. Set this when the host runs UTC — a UTC
|
|
# server is exactly the case that fails.
|
|
# BROWSER_TZ=Asia/Jakarta
|