p24-infra Docs

vps-h1

2 min read

[NIEAKTYWNE — WAHA zdecommissioned 2026-06-30] WAHA zastąpiona przez whatsup-android-chat-puller. Ten dokument zachowany jako archiwum historyczne. Patrz: issue #2007

Hostinger VPS vps-h1 — WAHA Gateway (PROTECTED)

Environment ID: vps-h1 Type: production Status: frozen

PROTECTED — this host is frozen. Role is fixed: WAHA WhatsApp gateway exclusively. Only allowed changes: OS/package security patches, Docker image CVE bumps, WAHA config, credential rotation. Do NOT add new Docker services, new ports, or new responsibilities to this host.

Purpose

Dedicated WAHA (WhatsApp API) gateway. Receives WhatsApp messages, verifies HMAC, and routes to the waha-router Cloudflare Worker which writes to Supabase. All processing happens downstream — vps-h1 only receives and forwards.

Hardware

FieldValue
ProviderHostinger
IP72.60.32.61
OSUbuntu 24.04.3 LTS
DNS*.vps-h1.infra.zintegrowana.online (wildcard → 72.60.32.61)

Running Containers

ContainerPurposePort
root-traefik-1TLS reverse proxy80, 443
wahaWhatsApp gateway (WAHA NOWEB, DE +49 1578 5573196)127.0.0.1:13000
root-node-exporter-1Host metricshost network
root-cadvisor-1Container metrics8080
root-promtail-1Log shipping to Loki9080

Compose file: /root/docker-compose.yml (tracked in hostinger/docker-compose.yml)

Access

# As root
ssh root@72.60.32.61 -i C:\Users\konar\.ssh\id_ed25519

Emergency console access: HOSTINGER_ROOT_PASSWORD in GH Secrets.

Claude Agent (claude-runner)

Corrected 2026-08-01 (docs/adr/002-claude-account-topology.md Phase 1, #4807) — this section previously stated the opposite of reality. vps-h1 does run a claude-runner user and Claude Code:

  • ansible/playbooks/vps-h1.yml:24 applies the claude-runner role to this host
  • .sops.yaml:4 lists “vps-h1 claude-runner” as a SOPS+age recipient
  • the templated /etc/cron.d/claude-token-refresh (ansible/roles/claude-runner/templates/claude-token-refresh.j2, rendered with vps-h1’s single-account claude_accounts default so no bogus --user claude-runner-2 line — #5189) and scripts/refresh-claude-token.py:75-84 both refresh the OAuth token on vps-h1 on the same schedule as bms-4/vps-i1
  • docs/elements.md:187 lists “Claude Code (Hostinger)” running /process-issues et-oper main at 03:30 UTC as claude-runner on this host, authenticated via Claude Max OAuth (see docs/adr/002-claude-account-topology.md for the shared-account topology across all three hosts)

The GH Actions self-hosted runner (a separate thing from claude-runner) was removed 2026-06-21 and should not be reinstalled — that removal is unrelated to and does not affect the claude-runner Claude Code agent, which remains active. Do not remove or disable claude-runner on this host without checking docs/adr/002-claude-account-topology.md and the current dispatch topology first.

Secrets

Primary source: secrets/vps-h1.env.sops (SOPS+age) Server fallback: /root/.env

Constraints

  • No new Docker services ever
  • No new ports ever
  • No Claude agents ever
  • Changes limited to: OS patches, Docker image CVE bumps, WAHA config, credential rotation

WAHA Endpoint

waha2.vps-h1.infra.zintegrowana.online — authenticated with WAHA_API_KEY

  • docs/waha-operations.md — WAHA configuration and operations
  • docs/waha-incident-router.md — waha-router Cloudflare Worker
  • docs/hostinger-runbook.md — host-level operations

Graph View