vh
b6924de728
nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake: verified health independently, brought it into the inventory, and fixed one security defect found during the check. - canonicalize stacks/hrafn/ (compose.yaml + .env.example + README) - list hrafn in the ana-docker running-stacks table - README records the load-bearing bits: shm_size 1gb is required for Chromium, playwright and the base image are version-coupled, SSRF denies private targets by default, and restart:unless-stopped does NOT act on healthcheck failure Security fix applied on the host, not in this tree: /opt/docker/compose/ hrafn/.env was 0644 with a live 57-char bearer token in it, readable by every local account (verified by reading it as `nobody`). Tightened to 0600; owner unchanged so the deploy path still works, confirmed via `docker compose config` as lkraven. Container untouched and still healthy. Known gaps recorded rather than silently accepted: no CI deploy, and the image builds from an rsync'd working tree living in the compose directory, so the running image has no commit provenance.
69 lines
3.1 KiB
Markdown
69 lines
3.1 KiB
Markdown
# ana-docker
|
|
|
|
General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0/16` that doesn't need a GPU — pair it with ana-ml2, which handles the GPU workloads.
|
|
|
|
## Network
|
|
|
|
- **LAN IP:** 10.250.50.70
|
|
- **FQDN:** `ana-docker.phasefinal.com`
|
|
- **SSH:** standard port 22
|
|
- **Traefik entrypoints:** 80/443 terminate here; cert resolver `anaprod` (Let's Encrypt)
|
|
|
|
## Hardware
|
|
|
|
- **CPU:** 8 vCPU (QEMU virtual — this is a VM)
|
|
- **RAM:** 15.6 GB
|
|
- **GPUs:** none
|
|
- **Storage:** 245 GB root (ext4) + NFS mounts from `10.250.50.50` (Debian 12 NFS/SMB file server; historically TrueNAS SCALE, since reprovisioned)
|
|
- **OS:** Debian 12 (bookworm), kernel 6.1.x
|
|
- **Docker:** 20.10.24
|
|
|
|
## Key paths
|
|
|
|
| Path | Purpose |
|
|
|------|---------|
|
|
| `/opt/docker/compose/<stack>/` | Compose files (also a git repo) |
|
|
| `/opt/docker/conf/<stack>/` | Config bind mounts |
|
|
| `/opt/docker/data/` | Service state (legacy — most stacks now use named volumes) |
|
|
| `/mnt/compose` | NFS — `10.250.50.50:/mnt/docker` |
|
|
| `/mnt/backup` | NFS — `10.250.50.50:/mnt/backup` (restic target) |
|
|
| `/mnt/tnvms` | NFS — `10.250.50.50:/mnt/pve-VMStorage` |
|
|
|
|
## Running stacks
|
|
|
|
| Stack | Port(s) | Notes |
|
|
|-------|---------|-------|
|
|
| traefik | 80 / 443 / 8380 | Reverse proxy + TLS (cert resolver `anaprod`) |
|
|
| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin |
|
|
| gitea | 3000 / 222 | Git hosting — `gitea.phasefinal.com` |
|
|
| vaultwarden | 9080 | Password vault — `vaultwarden.phasefinal.com` |
|
|
| synapse (+ synapse-db, element-web) | internal | Matrix homeserver — `matrix.phasefinal.com`, client at `chat.phasefinal.com` |
|
|
| seafile (+ mariadb, memcached) | 9180 | File sync — `seafile.phasefinal.com` |
|
|
| searxng | 9996 | Private search metaengine |
|
|
| openwebui | 3100 | Chat UI frontend |
|
|
| sillytavern | 8100 | Chat UI |
|
|
| mailrise | 8025 | SMTP-to-notification gateway |
|
|
| rustdesk (hbbs + hbbr) | host-net 21115-21119 | Remote desktop relay — `rustdesk.phasefinal.com` |
|
|
| dockge | 5001 | Docker stack management UI |
|
|
| beszel | 8090 | Fleet metrics hub (+ local agent); agents on the other hosts report here |
|
|
| dozzle (hub as `dozzle-hub`) | 8088 | Fleet log viewer; agents on the other hosts report here |
|
|
| restic rest-server | 8000 | Anaheim-side restic endpoint (writes to the NFS mount at `/mnt/backup/restic/repo/ana/`, backed by the Debian file server at `10.250.50.50`); paired with `rest-server-nh3` on the Synology for the NH3 side |
|
|
| backrest | 9898 | Fleet-wide restic snapshot viewer / restore UI — points at both rest-servers |
|
|
| it-tools | 8780 | Dev utilities |
|
|
| hrafn | internal only | Browser-fetch service (real Chromium behind a REST API) for bot-gated sites; consumers reach `http://hrafn:8080` on `traefik-net`. No host port by design. See `stacks/hrafn/` |
|
|
| mattermost | — | Stopped; kept around for reference |
|
|
|
|
Portainer was retired from this host; stack management is now handled via Dockge + Beszel.
|
|
|
|
## Refresh state
|
|
|
|
```bash
|
|
scripts/refresh-server-info.sh ana-docker
|
|
```
|
|
|
|
Latest snapshot: `system-details.txt` (regenerate as needed).
|
|
|
|
## Placement rule
|
|
|
|
If a new stack needs a GPU it goes on **ana-ml2**, otherwise it lands here.
|