Document Postgres persistence, selfapi space name, and UA/Cloudflare fix in README

Add a Persistence section with the Neon DATABASE_URL setup guide, a
self-hosting section for docker-compose, a UA-must-match-OS note, fix the
stale chrome -> selfapi space name/URLs and title, and update the boot
sequence + troubleshooting to match the current start_hf.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -1,5 +1,5 @@
 ---
-title: Chrome
+title: Selfapi
 emoji: 📊
 colorFrom: gray
 colorTo: blue
@@ -8,14 +8,16 @@ app_port: 3001
 pinned: false
 ---
 
-# Chrome Space — Headless Chrome + Unpacked Extensions
+# Selfapi — Headless Chrome + Unpacked Extensions
 
-A [Hugging Face Space](https://huggingface.co/spaces/akash1313/chrome) that runs a
+A [Hugging Face Space](https://huggingface.co/spaces/akash1313/selfapi) that runs a
 persistent, headless **Chrome for Testing** browser inside Docker with three custom
 unpacked extensions auto-loaded, plus a live web monitor to watch the browser in real time.
 
-The browser stays logged in across restarts (persistent profile), and the bundled
-extensions sync cookies / automate workflows for ChatGPT, Google Gemini, and Google Flow.
+The browser stays logged in across restarts — on Hugging Face the profile is snapshotted to
+a **Postgres database** (see [Persistence](#persistence-staying-logged-in) below); on a
+self-hosted Docker setup it lives in a named volume. The bundled extensions sync cookies /
+automate workflows for ChatGPT, Google Gemini, and Google Flow.
 
 ---
 
@@ -44,9 +46,10 @@ run yourself — see each subproject's README for setup):
 | [`free-gemini-api`](free-gemini-api/README.md) | Go reverse-proxy | local server | Gemini text / Imagen 3 images / Gemini video |
 | [`flow-agent`](flow-agent/README.md) | Python FastAPI + CLI | `127.0.0.1:8100` | Google Flow T2V / V2V / I2V video + T2I / I2I images |
 
-> ⚠️ This Space runs **only the browser + the 3 extensions**. It does **not** start the
-> backend servers — run those locally (or in their own containers) and the extensions will
-> connect once the matching port is reachable.
+> ⚠️ The HF Space builds **only the root `Dockerfile`** → it runs **the browser + the 3
+> extensions + the monitor**. It does **not** start the backend servers. To run the full
+> stack (browser **and** all three API servers sharing one loopback), use
+> `docker-compose.yml` for self-hosting — see [Self-hosting](#self-hosting-full-stack).
 
 ---
 
@@ -59,7 +62,10 @@ HF Space (port 3001)
 ┌─────────────────────────────────────────────────────────┐
 │ Docker container (Debian 12)                             │
 │                                                          │
-│  monitor-server ──┐  serves the live UI + /chrome.log    │
+│  profilesync ──► restores profile from Postgres on boot  │
+│   (Go)          and backs it up every 5 min / on exit    │
+│                   │                                      │
+│  monitor (3-tab) ─┤  serves the live UI + /chrome.log    │
 │   (Go, :3001)     │                                      │
 │                   ▼                                      │
 │  Chrome for Testing 145 (--headless=new)                 │
@@ -73,18 +79,59 @@ HF Space (port 3001)
 
 `start_hf.sh` is the boot sequence:
 
+0. **Restore profile** — if `DATABASE_URL` is set, `profilesync restore` pulls the last
+   Chrome profile snapshot from Postgres so logins survive an HF restart/rebuild.
 1. **Profile repair & cleanup** — fixes a nested `data/data` layout and removes cache/junk
    to keep the persistent profile small.
 2. **Lock removal** — clears `Singleton*` / `LOCK` files left by an unclean shutdown.
 3. **Preferences injection** — enables `extensions.ui.developer_mode` and sets a clean
    `exit_type` so the "restore pages?" popup never appears.
-4. **Monitor server** — starts the Go monitor on `:3001` and symlinks `chrome.log` into it.
+4. **Monitor server** — starts the Go 3-tab monitor on `:3001` and symlinks `chrome.log`.
 5. **CDP proxy** — `socat` exposes the DevTools port (9223 → 127.0.0.1:9222).
-6. **Auto-navigate** — a tiny WebSocket client drives the first tab to `chrome://extensions/`.
+6. **Auto-backup** — if `DATABASE_URL` is set, `profilesync backup` runs every 5 min (plus
+   a final backup on `SIGTERM`/`SIGINT` shutdown).
 7. **Launch Chrome** — Chrome for Testing in `--headless=new` with all three extensions.
 
 ---
 
+## Persistence (staying logged in)
+
+Hugging Face Spaces on the **free `cpu-basic` tier have no persistent disk** — the container
+filesystem (including `/home/chrome/data`) is **wiped on every restart, rebuild, or factory
+reboot**. To keep logins, the profile is snapshotted to an **external Postgres database**.
+
+How it works (the `profilesync` Go tool, built into the image):
+
+- **On boot:** restores the profile from Postgres (`profilesync restore`).
+- **Every 5 min + on shutdown:** backs the profile up (`profilesync backup`).
+- Stores it in one row: `chrome_profile(id, updated_at, data bytea)` — table auto-created.
+- **All of this is gated on the `DATABASE_URL` env var.** If it is not set, restore/backup
+  are silently skipped and logins are lost on restart.
+
+### Setup — one-time
+
+1. **Create a free Postgres** at [neon.tech](https://neon.tech) → new project → copy the
+   connection string. It looks like:
+   ```
+   postgresql://USER:PASSWORD@HOST.neon.tech/DBNAME?sslmode=require
+   ```
+2. **Add it as a Space secret:** HF Space → **Settings** → **Variables and secrets** →
+   **New secret**
+   - **Name:** `DATABASE_URL`
+   - **Value:** the connection string from step 1
+3. Saving the secret **auto-restarts** the Space. Because nothing was backed up yet, the
+   first boot has nothing to restore — so **log in once** after the secret is set. Within
+   5 minutes that login is snapshotted to Postgres and will survive all future restarts.
+
+> 💡 Verify a backup landed: connect to the DB and run
+> `SELECT id, updated_at, octet_length(data) FROM chrome_profile;` — a row with a non-zero
+> size means the profile is persisted.
+
+> 🔒 The connection string is a credential — keep it only in the HF secret. A local copy in
+> `neon-db` is **gitignored** so it never reaches this public repo.
+
+---
+
 ## Why Chrome for Testing (not regular Chrome)
 
 Branded **Google Chrome ≥ 128 silently ignores `--load-extension`** (removed by the
@@ -103,12 +150,29 @@ that binary. Everything else (monitor, CDP proxy, flags) is unchanged.
 
 ---
 
+## User-Agent must match the OS
+
+The Space runs on **Linux**, so Chrome (and the backend HTTP clients) advertise a **Linux**
+User-Agent:
+
+```
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
+```
+
+A **macOS UA on a Linux box is an inconsistency** that Cloudflare Turnstile flags, causing
+the ChatGPT "verify you are human" check to loop forever (the tick never clears). The browser
+UA lives in `start_hf.sh`; the ChatGPT backend (`chatgpt-free-api/cookies.go`) uses the **same
+UA and Chrome version (145)** so the `cf_clearance` cookie — which Cloudflare binds to the
+exact UA — stays valid across the browser and the backend.
+
+---
+
 ## Endpoints
 
 | URL | Description |
 |-----|-------------|
-| `https://akash1313-chrome.hf.space/` | Live Chrome monitor UI |
-| `https://akash1313-chrome.hf.space/chrome.log` | Streaming Chrome log (debugging) |
+| `https://akash1313-selfapi.hf.space/` | Live Chrome monitor UI |
+| `https://akash1313-selfapi.hf.space/chrome.log` | Streaming Chrome log (debugging) |
 | `127.0.0.1:9222` (in-container) | Chrome DevTools Protocol |
 | `:9223` | CDP proxied for external tools (via socat) |
 
@@ -119,7 +183,10 @@ that binary. Everything else (monitor, CDP proxy, flags) is unchanged.
 ```
 chrome-space/
 ├── Dockerfile              # builds on akashyadav758/chrome, installs CfT, copies extensions
+├── docker-compose.yml      # full self-host stack: browser + 3 API servers on one loopback
 ├── start_hf.sh             # container entrypoint / Chrome boot sequence
+├── profilesync/            # Go tool: Chrome profile <-> Postgres snapshot
+├── monitor/                # Go 3-tab live monitor (GPT / Gemini / Flow)
 ├── chatgpt-free-api/       # ChatGPT Free API server + gpt-extension
 ├── free-gemini-api/        # Free Gemini API server + gemini-extension
 └── flow-agent/             # Flow automation CLI + Flow-extension
@@ -127,9 +194,38 @@ chrome-space/
 
 ---
 
-## Local development
+## Deploy
+
+This repo **is** the HF Space — pushing to `main` triggers an automatic rebuild:
+
+```bash
+git push origin main
+```
+
+First-time / persistence checklist:
+
+1. Push the code (above).
+2. Set the `DATABASE_URL` secret — see [Persistence](#persistence-staying-logged-in).
+3. Log in once in the monitor UI; the profile auto-backs up within 5 min.
+
+> `hf-token` and `neon-db` are gitignored — keep your HF token and DB credentials out of
+> commits.
+
+---
+
+## Self-hosting (full stack)
+
+To run the browser **and** all three backend API servers locally, use `docker-compose.yml`.
+The server containers join the chrome container's network namespace
+(`network_mode: "service:chrome"`), so they all share one `127.0.0.1` — exactly what the
+extensions expect. The Chrome profile persists in a named Docker volume (no Postgres needed).
+
+```bash
+docker compose up --build -d      # browser + chatgpt + gemini + flow
+docker compose down               # profile survives in the chrome-profile volume
+```
 
-Requires Docker. The base image is `linux/amd64` only.
+Or just the browser image:
 
 ```bash
 # Build
@@ -147,22 +243,12 @@ Open <http://localhost:3001> to watch the browser.
 
 ---
 
-## Deploy
-
-This repo **is** the HF Space — pushing to `main` triggers an automatic rebuild:
-
-```bash
-git push origin main
-```
-
-> `hf-token` is gitignored — keep your Hugging Face token out of commits.
-
----
-
 ## Troubleshooting
 
 | Symptom | Cause / fix |
 |---------|-------------|
+| Login lost after restart/rebuild | `DATABASE_URL` not set (or DB unreachable) → set the Postgres secret, see [Persistence](#persistence-staying-logged-in) |
+| ChatGPT Cloudflare "verify you are human" loops, tick never passes | UA/OS mismatch (macOS UA on Linux) — ensure the **Linux** UA in `start_hf.sh`. If it still loops, it's the **datacenter IP** (HF = AWS); route through a residential proxy via `--proxy-server=http://user:pass@host:port` |
 | `chrome://extensions/` empty, no error in log | Branded Chrome ignoring `--load-extension` → use Chrome for Testing (see above) |
 | `COPY failed: ... not found` at build | Extension source dir name in the Dockerfile doesn't match disk |
 | Extension listed but service worker idle | MV3 headless quirk — open the extension's toggle or hit **Update** on the extensions page |