vh
b6924de728
nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake: verified health independently, brought it into the inventory, and fixed one security defect found during the check. - canonicalize stacks/hrafn/ (compose.yaml + .env.example + README) - list hrafn in the ana-docker running-stacks table - README records the load-bearing bits: shm_size 1gb is required for Chromium, playwright and the base image are version-coupled, SSRF denies private targets by default, and restart:unless-stopped does NOT act on healthcheck failure Security fix applied on the host, not in this tree: /opt/docker/compose/ hrafn/.env was 0644 with a live 57-char bearer token in it, readable by every local account (verified by reading it as `nobody`). Tightened to 0600; owner unchanged so the deploy path still works, confirmed via `docker compose config` as lkraven. Container untouched and still healthy. Known gaps recorded rather than silently accepted: no CI deploy, and the image builds from an rsync'd working tree living in the compose directory, so the running image has no commit provenance.
26 lines
772 B
YAML
26 lines
772 B
YAML
# hrafn — internal fleet service. No published host port; consumers reach
|
|
# it at http://hrafn:8080 on the shared network (contract § Deployment).
|
|
services:
|
|
hrafn:
|
|
build: .
|
|
image: local/hrafn:${HRAFN_TAG:-v1}
|
|
container_name: hrafn
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
networks:
|
|
- traefik-net
|
|
# Chromium wants a larger shared-memory segment than Docker's 64MB
|
|
# default or it crashes on some pages.
|
|
shm_size: "1gb"
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c",
|
|
"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/readyz').status==200 else 1)"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
|
|
networks:
|
|
traefik-net:
|
|
external: true
|