VPS Services

VPS Services

PolicyWatcher can use two companion services outside Hostinger:

1. Renderer VPS
2. VPS Operations Agent

They are optional, but recommended for production-grade retrieval and recovery operations.

Renderer VPS

The renderer is a Playwright-based service used when direct HTTP and HTTP/2 retrieval are insufficient for script-rendered policy pages.

Features:

• bearer-token authentication;
• /healthz public health endpoint;
• /render protected render endpoint;
• SSRF validation for initial URLs, redirects and subresource requests;
• sanitized error responses;
• bounded concurrency.

The renderer should not be used to bypass provider access controls. If a provider blocks automation, PolicyWatcher should record the source anomaly and suspend the source when evidence cannot be obtained.

VPS Operations Agent

The operations agent is a separate control plane for:

• fixed smoke checks;
• backups;
• checksum-verified local package updates;
• rollback;
• capped operation logs;
• renderer current symlink inspection.

The agent uses HMAC-signed requests with timestamp and nonce replay protection. It must not accept arbitrary URLs, shell commands or package download URLs.

Admin Integration

The admin /admin/vps-services page reports:

• renderer health;
• renderer latency;
• active renders;
• smoke-test status;
• agent health;
• current renderer version;
• operation lock state;
• backup/update/rollback controls where configured.

Required Environment Variables

RENDERER_URL=https://render.policywatcher.online
RENDERER_SECRET=<high-entropy-renderer-secret>

VPS_AGENT_URL=https://ops.policywatcher.online
VPS_AGENT_SECRET=<high-entropy-agent-secret>