p24-infra Docs

bms-4

3 min read

OVH Kimsufi bms-4 (ns3101999) — MongoDB Arbiter + n8n Host + AI Runner

Environment ID: bms-4 Type: production Status: active

Purpose

Triple-role server:

  1. MongoDB rs0 arbiter — provides quorum vote for failover without holding data
  2. n8n queue-mode automation host — runs n8n with 3 dedicated workers + Redis
  3. AI-Dev-BMS4-1 Claude runner — autonomous Claude Code agent host (max 4 parallel)

Hardware

FieldValue
Labelp4-ovh-bms-4-ns3101999
Hostnamens3101999
ProviderOVH / Kimsufi dedicated
IP54.36.123.110
OSUbuntu 22.04.5 LTS
vCPU8
RAM32 GB

Running Containers

ContainerPurposePort
node_exporterHost metrics9100
cadvisorContainer metrics8080
traefikTLS reverse proxy for n8n80, 443
redisn8n queue backend6379 (internal)
n8nn8n queue-mode main instanceinternal
n8n-worker-1n8n worker 1internal
n8n-worker-2n8n worker 2internal
n8n-worker-3n8n worker 3internal
mongod-arbiterMongoDB 7.0 rs0 arbiter27017 (internal)

MongoDB rs0 Role

FieldValue
Replica setrs0
RoleArbiter — votes only, holds no data
Joined2026-06-10
PurposeProvides quorum vote when bms-2/bms-3 split

n8n Automation

FieldValue
URLn8n.bms-4.infra.zintegrowana.online
ModeQueue mode with 3 workers + Redis
Authn8n login
Secretssecrets/n8n-bms4.env.sops (SOPS+age)

n8n handles: WhatsApp incident routing, Atrax GPS sync, vehicle data automation, HeyGen video generation, BrandPilot workflows.

AI-Dev-BMS4-1 Claude Agent

FieldValue
GitHub userAI-Dev-BMS4-1
AuthOAuth subscription (Claude Max) — not API key
Credentials/home/claude-runner/.claude/.credentials.json
Max parallel agents4
Rolesaas-dev
Resource noteShares 32 GB RAM with n8n + MongoDB arbiter

Worker scratch hygiene (#7724 / #7813). bms-4 is the shared worker host where the #7724 leak accumulated (multiple local accounts: claude-runner, claude-runner-2, ubuntu). Every worker is launched with umask 077 and an owner-only 0700 per-worker TMPDIR (/tmp/p24-worker-<issue>-XXXXXX, created + reaped by scripts/spawn-worker.sh), so scratch is owner-only and its filenames are not even listable by other accounts. An hourly root cron (check-tmp-secret-scratch.sh → p24_tmp_secret_scratch_count → TmpSecretScratchExposed) watches for a relapse. See docs/playbooks/worker-tmp-secret-hygiene.md and docs/playbooks/worker-secrets-handling.md.

GitHub Actions Self-Hosted Runners

bms-4 hosts repo-scoped GitHub Actions runners (systemd units actions.runner.<repo>.<name>.service, run as user claude-runner). Inventory (2026-10-08, #7640):

Runner nameRepoOS pathLabels
bms4-etopet-operational-platform/opt/actions-runner-bms4-etopself-hosted, Linux, X64, bms4, heavy, playwright
bms4-p24infrap24-infra/opt/actions-runner-bms4-p24self-hosted, Linux, X64, bms4, heavy, playwright, secrets-deploy
bms4-p24infra-extra1/2/3p24-infra/opt/gh-runner, -2, -3self-hosted, Linux, X64, bms4, secrets-deploy
bms4-p24infra-light1/2p24-infra/opt/gh-runner-light-1, -2self-hosted, Linux, X64, dispatch-light (no bms4)
bms4-androidwhatsup-android-chat-puller/home/claude-runner/gh-runnerself-hosted, Linux, X64

The *-light* runners are the dispatch-light tier (#7640): a MemoryMax=1G + CPUWeight=200 systemd drop-in (…/actions.runner.radieu-p24-infra.bms4-p24infra-light{1,2}.service.d/resource.conf, Restart=always), dedicated to tiny queue-trigger workflows so they stop queueing behind the 6-min Self Test jobs on the bms4-labelled runners. Label policy + rationale: docs/playbooks/gh-runner-assignment-policy.md. Process-liveness metrics (gh_runner_up) come from /usr/local/bin/gh-runner-metrics.sh (root cron, 1 min → node_exporter textfile).

Access

# As root (human developer)
ssh root@54.36.123.110 -i C:\Users\konar\.ssh\id_ed25519
 
# As ubuntu
ssh ubuntu@54.36.123.110 -i C:\Users\konar\.ssh\id_ed25519

Secrets

  • n8n stack: secrets/n8n-bms4.env.sops (SOPS+age)
  • MongoDB arbiter: secrets/bms-servers.env.sops (SOPS+age)
  • Server fallback: /opt/p24-infra/bms-4/.env

Secrets Access

Secret storeAccess methodCan decrypt SOPS?
All secrets/*.env.sops filesage key at /home/claude-runner/.age/p24-infra-keys.txtYes � claude-runner has the age key (verified 2026-06-24)
On-server plaintext fallback/opt/p24-infra/bms-4/.env (deployed by CI)N/A � already plaintext
GitHub Actions secretsNot accessible from VPS directlyN/A

bms-4 / AI-Dev-BMS4-1 does hold the SOPS age key and can decrypt all SOPS files directly.

Resource Budget (32 GB RAM)

ComponentExpected RAMNotes
MongoDB arbiter (mongod)~200 MBArbiter holds no data � minimal footprint
n8n main instance~400 MBQueue-mode coordinator only
n8n worker � 3~800 MB each = ~2.4 GBRises to ~1.2 GB/worker under Playwright load
Redis~100 MBn8n queue backend
Traefik~50 MBTLS proxy
node_exporter + cAdvisor~100 MB combinedMetrics exporters
Claude Code agents � 4~700 MB each = ~2.8 GBPer-agent process + git worktree I/O
OS + buffers~2 GBUbuntu 22.04 baseline
Total (light n8n load)~8 GBComfortable headroom
Total (heavy n8n Playwright load)~14�16 GBSafe, monitor
Total (heavy n8n + 4 Claude agents)~16�18 GBWatch � OOM risk if n8n spikes

OOM risk flag: Running 4 Claude agents simultaneously while n8n executes Playwright-heavy workflows (browser automation) can push total RAM to 18�20 GB. Monitor via node_exporter / Grafana node_memory_MemAvailable_bytes. If available RAM drops below 4 GB, reduce Claude agent concurrency to 2.

Operations

# Check n8n status
ssh root@54.36.123.110 "cd /opt/p24-infra/bms-4 && docker compose ps"
 
# Check arbiter status in MongoDB rs
ssh root@54.36.123.110 "mongosh --eval 'rs.status()'"
  • docs/servers/p4-ovh-bms-4-ns3101999-operations.md — detailed operational runbook
  • docs/n8n-operations.md — n8n queue-mode configuration
  • docs/mongodb-rs0-operations.md — replica set management

Graph View

Backlinks