vh
b6924de728
nevermore-claude handed hrafn to infra-ops for uptime ownership. Intake: verified health independently, brought it into the inventory, and fixed one security defect found during the check. - canonicalize stacks/hrafn/ (compose.yaml + .env.example + README) - list hrafn in the ana-docker running-stacks table - README records the load-bearing bits: shm_size 1gb is required for Chromium, playwright and the base image are version-coupled, SSRF denies private targets by default, and restart:unless-stopped does NOT act on healthcheck failure Security fix applied on the host, not in this tree: /opt/docker/compose/ hrafn/.env was 0644 with a live 57-char bearer token in it, readable by every local account (verified by reading it as `nobody`). Tightened to 0600; owner unchanged so the deploy path still works, confirmed via `docker compose config` as lkraven. Container untouched and still healthy. Known gaps recorded rather than silently accepted: no CI deploy, and the image builds from an rsync'd working tree living in the compose directory, so the running image has no commit provenance.
hrafn
Browser-fetch service — a genuine Chromium kept behind a REST API so consumers never have to embed a browser themselves. It exists because bot-gated sites (Reddit first) 403 every non-browser client; hrafn is the one place in the fleet that keeps a real browser warm.
Deploys to:
- ana-docker (10.250.50.70) — internal-only, no published host port.
Consumers reach it at
http://hrafn:8080ontraefik-net.
Built and handed to infra-ops for uptime ownership by nevermore-claude,
2026-08-22. Upstream source: vh/hrafn (private gitea repo).
Reaching it
There is no host port — this is deliberate (contract § Deployment). Only
containers on traefik-net can talk to it:
# from another container on traefik-net
curl -H "Authorization: Bearer $HRAFN_TOKEN" \
-X POST http://hrafn:8080/v1/fetch -d '{"url":"https://example.com"}'
# from the host, for diagnostics only
ssh infra-ops@10.250.50.70 \
'sudo docker run --rm --network traefik-net curlimages/curl:latest \
-s -o /dev/null -w "%{http_code}\n" http://hrafn:8080/readyz'
/readyz and the other health endpoints are unauthenticated; POST /v1/fetch
requires the bearer token.
Credentials
HRAFN_TOKEN lives in /opt/docker/compose/hrafn/.env on the host and is
vaulted at ana-docker/hrafn/bearer-token (secrets-broker). The .env is
0600 — it was 0644 on handoff, which exposed a live bearer token to every
local account on the box; tightened 2026-08-22. Keep it 0600.
Operational notes
shm_size: 1gbis load-bearing. Chromium crashes on some pages with Docker's 64 MB default. Don't trim it to save memory.- Playwright and the base image are version-coupled. Base is
mcr.microsoft.com/playwright/python:v1.62.0-noblewith playwright pinned to1.62.0. Bump both together or the browser binary and the client library disagree. - SSRF is denied by default — private and reserved targets are refused
unless listed in
HRAFN_PRIVATE_ALLOWLIST, which is empty. Leave it empty unless there is a specific internal target and a reason. restart: unless-stoppeddoes not act on the healthcheck. Docker restarts on exit, not on unhealthy. A wedged-but-running Chromium will sit there marked unhealthy indefinitely. Beszel on this host reports container status, so that is the alerting path.
Deploy
No CI deploy is wired. As of the handoff the image builds from a working
tree rsync'd into the compose directory, so /opt/docker/compose/hrafn/
contains the full source (src/, tests/, pyproject.toml, …) rather than
just a compose file. That is a deviation from the house convention and means
the running image has no commit provenance.
Current update path:
ssh infra-ops@10.250.50.70
cd /opt/docker/compose/hrafn
# rsync the updated working tree in, then:
sudo docker compose build && sudo docker compose up -d
sudo docker compose ps # expect (healthy)
Known gaps
| gap | impact | status |
|---|---|---|
| No CI deploy | manual rsync + build; no provenance for what is running | offered by nevermore-claude, not yet built |
| Source tree in the compose dir | deviates from /opt/docker/compose/<stack>/compose.yaml convention |
needs a host-clone or registry-image deploy shape |
| No homepage entry | internal-only service, so arguably correct | intentional for now |