vh
b6924de728
nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake: verified health independently, brought it into the inventory, and fixed one security defect found during the check. - canonicalize stacks/hrafn/ (compose.yaml + .env.example + README) - list hrafn in the ana-docker running-stacks table - README records the load-bearing bits: shm_size 1gb is required for Chromium, playwright and the base image are version-coupled, SSRF denies private targets by default, and restart:unless-stopped does NOT act on healthcheck failure Security fix applied on the host, not in this tree: /opt/docker/compose/ hrafn/.env was 0644 with a live 57-char bearer token in it, readable by every local account (verified by reading it as `nobody`). Tightened to 0600; owner unchanged so the deploy path still works, confirmed via `docker compose config` as lkraven. Container untouched and still healthy. Known gaps recorded rather than silently accepted: no CI deploy, and the image builds from an rsync'd working tree living in the compose directory, so the running image has no commit provenance.
ana-docker
General-purpose Docker host for the Anaheim colo. Runs everything at 10.250.0.0/16 that doesn't need a GPU — pair it with ana-ml2, which handles the GPU workloads.
Network
- LAN IP: 10.250.50.70
- FQDN:
ana-docker.phasefinal.com - SSH: standard port 22
- Traefik entrypoints: 80/443 terminate here; cert resolver
anaprod(Let's Encrypt)
Hardware
- CPU: 8 vCPU (QEMU virtual — this is a VM)
- RAM: 15.6 GB
- GPUs: none
- Storage: 245 GB root (ext4) + NFS mounts from
10.250.50.50(Debian 12 NFS/SMB file server; historically TrueNAS SCALE, since reprovisioned) - OS: Debian 12 (bookworm), kernel 6.1.x
- Docker: 20.10.24
Key paths
| Path | Purpose |
|---|---|
/opt/docker/compose/<stack>/ |
Compose files (also a git repo) |
/opt/docker/conf/<stack>/ |
Config bind mounts |
/opt/docker/data/ |
Service state (legacy — most stacks now use named volumes) |
/mnt/compose |
NFS — 10.250.50.50:/mnt/docker |
/mnt/backup |
NFS — 10.250.50.50:/mnt/backup (restic target) |
/mnt/tnvms |
NFS — 10.250.50.50:/mnt/pve-VMStorage |
Running stacks
| Stack | Port(s) | Notes |
|---|---|---|
| traefik | 80 / 443 / 8380 | Reverse proxy + TLS (cert resolver anaprod) |
| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin |
| gitea | 3000 / 222 | Git hosting — gitea.phasefinal.com |
| vaultwarden | 9080 | Password vault — vaultwarden.phasefinal.com |
| synapse (+ synapse-db, element-web) | internal | Matrix homeserver — matrix.phasefinal.com, client at chat.phasefinal.com |
| seafile (+ mariadb, memcached) | 9180 | File sync — seafile.phasefinal.com |
| searxng | 9996 | Private search metaengine |
| openwebui | 3100 | Chat UI frontend |
| sillytavern | 8100 | Chat UI |
| mailrise | 8025 | SMTP-to-notification gateway |
| rustdesk (hbbs + hbbr) | host-net 21115-21119 | Remote desktop relay — rustdesk.phasefinal.com |
| dockge | 5001 | Docker stack management UI |
| beszel | 8090 | Fleet metrics hub (+ local agent); agents on the other hosts report here |
dozzle (hub as dozzle-hub) |
8088 | Fleet log viewer; agents on the other hosts report here |
| restic rest-server | 8000 | Anaheim-side restic endpoint (writes to the NFS mount at /mnt/backup/restic/repo/ana/, backed by the Debian file server at 10.250.50.50); paired with rest-server-nh3 on the Synology for the NH3 side |
| backrest | 9898 | Fleet-wide restic snapshot viewer / restore UI — points at both rest-servers |
| it-tools | 8780 | Dev utilities |
| hrafn | internal only | Browser-fetch service (real Chromium behind a REST API) for bot-gated sites; consumers reach http://hrafn:8080 on traefik-net. No host port by design. See stacks/hrafn/ |
| mattermost | — | Stopped; kept around for reference |
Portainer was retired from this host; stack management is now handled via Dockge + Beszel.
Refresh state
scripts/refresh-server-info.sh ana-docker
Latest snapshot: system-details.txt (regenerate as needed).
Placement rule
If a new stack needs a GPU it goes on ana-ml2, otherwise it lands here.