- local wrapper now prompts interactively for the operator to type the
exact DEPLOY_TARGET before it will even upload/run the remote script;
refuses to run without a TTY. --yes alone is no longer enough.
- remote script takes a fresh backup.sh snapshot right before wiping
mongo/redis/minio (aborts the reset if the backup fails) unless
--skip-backup is explicitly passed on both ends.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verified live on prod (systemd-run with the same User=harbor,
NoNewPrivileges=true, ProtectSystem=strict, ProtectHome=true,
ReadWritePaths=/var/lib/harbor as harbor-worker@.service) that Chromium's
unprivileged-userns sandbox launches and navigates fine without
--no-sandbox; kernel.unprivileged_userns_clone=1 on this host makes it
unnecessary. Keeping the browser's own renderer/GPU sandbox gives real
defense-in-depth against a malicious/compromised public Threads page,
instead of relying on systemd's process-level ProtectSystem alone.
Needs a normal release (build-release.sh + activate-release.sh) to reach
prod; not hot-patched on the live host.
Co-authored-by: Cursor <cursoragent@cursor.com>
- job: cap concurrent persona_analyze_account (real headless-Chromium scrape)
jobs per owner to 1 in flight via CountActiveByOwnerAndTemplate; rejects
with the new ErrTooManyActive (429) instead of letting a member queue up
many scrapes and pin the shared 1-vCPU host, or double-schedule the same
persona while a previous run is still executing.
- harbor-worker@.service: CPUQuota=70% so nginx/gateway keep headroom while
a scrape job briefly saturates Chromium.
- backup.sh: default BACKUP_DIR now matches the systemd unit (/var/backups/harbor)
instead of the stale /var/backups/haixun default.
- add harbor-job-health.timer (every 5m): queries Mongo for jobs that failed
in the last 15 minutes and writes a node-exporter textfile-collector
metric (haixun_job_failures_recent), with new Prometheus alerts
(PersonaScrapeJobsFailing / BackgroundJobsFailing / JobHealthMetricStale)
so a stuck worker surfaces on its own instead of only via member reports —
this would have caught the recent Playwright headless-shell bug directly.
- add harbor-offsite-backup.timer + backup/offsite-sync.sh: pushes
backup.sh's local backups to an off-host restic repository (client-side
encrypted). Installed and enabled by default but a safe no-op until
RESTIC_REPOSITORY/RESTIC_PASSWORD are set in harbor.env.
Co-authored-by: Cursor <cursoragent@cursor.com>
- release layout now ships scripts/threads-profile/scrape.mjs + node_modules;
activate-release.sh verifies it exists before activating a release
- profile_scrape.go resolves the script path relative to the release dir
(bin/{gateway,worker} -> ../scripts/threads-profile/scrape.mjs) in prod,
falling back to the dev-tree relative paths for local runs
- bootstrap.sh: Playwright 1.49+ needs a separate chromium-headless-shell
build for headless launches; the idempotency check only looked for
chromium-*, so a stalled/partial headless-shell download from an earlier
run was never retried. Now checks and installs both builds.
- add reset-data.sh (local wrapper + remote script) to wipe Mongo/Redis/MinIO
and reseed the admin account for a clean-slate redeploy
Co-authored-by: Cursor <cursoragent@cursor.com>
王性驊