matthias/server_cloud_ladkau_de
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add fuelish API; protect the host against memory exhaustion

Browse Source 
- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated
This commit is contained in:
ml
2026-10-04 13:54:09 +02:00
parent 974486bc53
commit 82d944a0a8
15 changed files with 246 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/runbook-provisioning.md
+14 -9
View File
@@ -82,6 +82,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
| vault.ladkau.de | A → server IP |
| dl.ladkau.de | A → server IP |
| agent.ladkau.de | A → server IP |
| fuelish.ladkau.de | A → server IP |
### 4. Create the vault and populate secrets
@@ -122,15 +123,18 @@ registry_users:
- username: alice
password: "your-password"
# n8n — AI chat and scheduled digests at agent.ladkau.de
# Fuelish — receipt OCR API at fuelish.ladkau.de
fuelish_api_key: "" # generate: openssl rand -hex 32 — same value in the Android app settings
# n8n — AI chat, Telegram bot and scheduled digests at agent.ladkau.de
n8n_users: # basic auth in front of n8n
- username: admin
password: "your-password"
n8n_encryption_key: "" # generate: openssl rand -hex 32 — never change after first deploy
searxng_secret_key: "" # generate: openssl rand -hex 32
searxng_secret_key: "" # generate: openssl rand -hex 32 — SearXNG, the internal search backend of the n8n chat
smtp_user: "" # full Strato mailbox address
smtp_password: ""
gemini_api_key: "" # Google AI Studio API key, see runbook-configuration.md section 9.8
gemini_api_key: "" # Google AI Studio API key, see runbook-configuration.md section 9.8
telegram_bot_token: "" # from @BotFather, see runbook-configuration.md section 9.8
telegram_user_id: "" # your numeric Telegram user id
@@ -222,11 +226,11 @@ This runs all roles in order:
| # | Role | What it does |
|----|---------------|--------------|
| 1 | `base` | OS hardening, deploy user, SSH config, ufw firewall, fail2ban |
| 1 | `base` | OS hardening, deploy user, SSH config, ufw firewall, fail2ban, swap file |
| 2 | `docker` | Docker Engine + Compose plugin, shared Traefik network |
| 3 | `traefik` | Reverse proxy, automatic TLS via Let's Encrypt |
| 4 | `gitea` | Self-hosted Git with PostgreSQL |
| 5 | `act_runner` | Three Gitea Actions runners with Docker executor |
| 5 | `act_runner` | Three Gitea Actions runners with Docker executor; job containers capped at `act_runner_job_memory` |
| 6 | `nextcloud` | File storage with PostgreSQL, Redis, cron sidecar |
| 7 | `sso` | Keycloak single sign-on with PostgreSQL |
| 8 | `mail` | Roundcube webmail client with PostgreSQL |
@@ -235,10 +239,11 @@ This runs all roles in order:
| 11 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
| 12 | `dl` | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
| 13 | `ollama` | Local LLM server (Ollama, CPU) on the internal `ollama_internal` network — pulls `ollama_model` on first run |
| 14 | `browserless` | Headless Chromium for rendering JavaScript-heavy pages — internal network only |
| 15 | `searxng` | Metasearch engine for the chat web_search tool — internal network only |
| 16 | `n8n` | n8n at agent.ladkau.de — AI chat (`/chat`), scheduled digests, basic auth; imports the workflows in the repo |
| 17 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
| 14 | `fuelish` | Receipt OCR job API for the Android app at fuelish.ladkau.de — image from the private registry, API-key auth |
| 15 | `browserless` | Headless Chromium for rendering JavaScript-heavy pages — internal network only |
| 16 | `searxng` | Metasearch engine for the chat web_search tool — internal network only |
| 17 | `n8n` | n8n at agent.ladkau.de — AI chat (`/chat`), scheduled digests, basic auth; imports the workflows in the repo |
| 18 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
> **Note:** The `act_runner` role requires `gitea_runner_registration_token` in the
> vault, which can only be obtained after Gitea is running and an admin account has