Frank
207235420c
Adds a digest-pinned headless-shell Chrome DevTools Protocol daemon as a boot-persistent quadlet unit (chrome-devtools-protocol.container). The entrypoint override drops the image's socat front so the CDP endpoint binds loopback-only on 127.0.0.1:9222 in the host network namespace; only the two host-network consumers (Signal gateway, webui server) can drive it. hermes-webui flips Network=dankclaw_default -> Network=host so its agent process shares the daemon's namespace (0.0.0.0:8787 bind is LAN-facing as before; no exposure change). deploy_hermes installs the new unit and starts it if inactive without restarting in-flight browser sessions.
39 lines
1.7 KiB
INI
39 lines
1.7 KiB
INI
# Quadlet unit: Chrome DevTools Protocol daemon for the hermes agent (rootless).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/chrome-devtools-protocol.container
|
|
# Unit name: chrome-devtools-protocol.service (container name: chrome-devtools-protocol)
|
|
#
|
|
# Headless Chrome exposing raw CDP over http://127.0.0.1:9222. The hermes
|
|
# agent's chrome-devtools MCP client (mcp_servers.chrome-devtools in
|
|
# /data/config.yaml) spawns npx chrome-devtools-mcp with --browserUrl pointing
|
|
# at this endpoint and drives the browser over it. Both consumers — the Signal
|
|
# gateway and the webui server — run in the host network namespace, so a
|
|
# loopback-only bind is reachable by exactly the processes that may drive the
|
|
# browser and by nobody else on the LAN or WAN.
|
|
#
|
|
# Entrypoint override drops the image's socat front (which would bind
|
|
# 0.0.0.0:9222 in the host namespace and hand browser control to the whole
|
|
# LAN). --no-sandbox is required because rootless podman grants Chrome no user
|
|
# namespace for its sandbox; the content processes therefore run as the uid
|
|
# that already owns this container, capping the blast radius of a hostile page.
|
|
# Image pinned by digest: upgrades are a deliberate unit edit + redeploy, not a
|
|
# tag drift at pull time.
|
|
|
|
[Unit]
|
|
Description=Chrome DevTools Protocol daemon (headless-shell) for hermes
|
|
|
|
[Container]
|
|
ContainerName=chrome-devtools-protocol
|
|
Network=host
|
|
Image=docker.io/chromedp/headless-shell@sha256:2d349b544a1ea6b5b5fd7c0fe99215ff662339c57407ee2e8c0a11af93516b04
|
|
Entrypoint=/headless-shell/headless-shell
|
|
Exec=--no-sandbox --disable-gpu --use-gl=angle --use-angle=swiftshader --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222
|
|
ShmSize=1073741824
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|