snapshot: preserve central wiki state 2026-08-15 (7 modified + 1 new file)

systems/headless-server.md

@@ -0,0 +1,40 @@
+---
+title: Headless Server
+type: system
+status: active
+created: 2026-07-22
+updated: 2026-07-22
+verified_on: 2026-07-22
+confidence: high
+tags: [system, browser]
+sources: [raw/configs/hermes-config-sanitized.txt]
+---
+
+# Headless Server
+
+## Purpose
+Headless X11 environment backing Hermes's browser automation and any GUI tooling.
+
+## Location
+- **Host:** this container (ct460, `hermes`), no separate VM/LXC — headless stack runs directly alongside the agent.
+- **Display:** `Xvfb :99`, resolution `1600x1200x24`, started with `-ac -nolisten tcp`
+
+## Current configuration (verified via `ps aux`, 2026-07-22)
+| Process | Detail |
+|---|---|
+| `Xvfb` | `:99 -screen 0 1600x1200x24 -ac -nolisten tcp` |
+| `fluxbox` | window manager on `:99` |
+| `x11vnc` | `-display :99 -forever -shared -rfbport 5901 -rfbportv6 5901 -noxdamage -quiet -nopw` — **no VNC password set** |
+| `websockify` ×2 | `127.0.0.1:6080 → 127.0.0.1:5900` and `127.0.0.1:6081 → 127.0.0.1:5901`, serving noVNC (`/usr/share/novnc`) |
+
+Two VNC/websockify pairs exist (5900/6080 and 5901/6081) — the second (`:99`→5901→6081) is the one confirmed above; the first (5900→6080) predates it and wasn't independently re-verified this pass — **unresolved** whether it's a second live display or a leftover process.
+
+## Connected systems
+- [[systems/hermes-agent]] (browser backend uses this display — see [[systems/browser-backend]] / [[comparisons/camoufox-vs-chrome]])
+- [[infrastructure/hosts]]
+
+## Known issues
+- `x11vnc -nopw`: VNC is unauthenticated. It's bound to all interfaces (`0.0.0.0:5901` and `[::]:5901`), not just loopback — reachable from the LAN and, if any tunnel/firewall rule forwards it, potentially beyond. Worth restricting to loopback or adding `-passwd`/`-rfbauth` if this hasn't been a deliberate choice.
+
+## Relevant runbooks
+- [[runbooks/restart-browser]]