mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
6e98ecf66f
csp-checker navigates every URL with a 20000 ms budget until domcontentloaded. Over the Tor SOCKS proxy that expires before a page of module scripts finishes: run 34614940508 lost Mastodon#1 and OpenProject#1 to it, 26 of 27 attempts logging "Unable to reach http://<onion>/ (Navigation timeout of 20000 ms exceeded)" while sys-service-terminator retried the unit for 35 minutes. No policy was ever read; the checker never got that far. csp-checker 2.3.0 takes --timeout, so script.py takes --onion-timeout and hands it to the onion batch alone, before the -- separator that would make it a URL. Clearnet keeps the image default. The budget is HEALTH_CSP_TIMEOUT_MS (20000, the image default) times the tor flavor's multiplier, 100000 ms on the public network. The unit's TimeoutStartSec had to follow. It was 30 + 25 s per domain -- 130 s for the two onion vhosts Mastodon checks, while a 100 s budget needs up to 200 s, so systemd would have killed the check mid-run. The filter now takes onion_per_domain_seconds and counts .onion domains at that rate; without the argument it computes exactly what it did before, so sys-ctl-hlth-webserver is unchanged. The Mastodon case goes from 130 s to 450 s, a clearnet-only play stays at 130 s. Tests pin that --timeout is appended only when set and stays ahead of the separator, that main budgets the onion batch alone, that the role passes both --onion-timeout and the onion rate for the start budget (both guards fail against the previous tasks file), and the filter's split rate. Not covered: the filter still caps at 3600 s, which binds beyond 34 onion domains in one round. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
19 lines
844 B
YAML
19 lines
844 B
YAML
---
|
|
# List of domains whose network block failures (e.g., ORB) should be ignored
|
|
# during CSP checks. This is useful for suppressing known external resources
|
|
# (e.g., third-party CDNs) that cannot be influenced but otherwise cause
|
|
# unnecessary alerts in the crawler reports.
|
|
HEALTH_CSP_IGNORE_NETWORK_BLOCKS_FROM: []
|
|
# Docker image to run
|
|
HEALTH_CSP_IMAGE: "{{ lookup('config', 'sys-ctl-hlth-csp', 'services.csp-checker.image') }}:{{ lookup('config', 'sys-ctl-hlth-csp', 'services.csp-checker.version')
|
|
}}"
|
|
|
|
# If true, pull the image on each run (safe but slower)
|
|
HEALTH_CSP_ALWAYS_PULL: false
|
|
|
|
# Navigation budget in milliseconds a clearnet vhost gets; mirrors the checker's own default
|
|
HEALTH_CSP_TIMEOUT_MS: 20000
|
|
|
|
# Seconds added per vhost on top of its navigation budget when sizing TimeoutStartSec
|
|
HEALTH_CSP_DOMAIN_RESERVE_SECONDS: 5
|