diff --git a/ai/compose.yml b/ai/compose.yml index 2e565ae..fe84ccb 100644 --- a/ai/compose.yml +++ b/ai/compose.yml @@ -26,7 +26,10 @@ services: # - "traefik.http.routers.webui-https.tls.certresolver=njalla" hermes: - build: ./hermes + build: + context: ./hermes + ssh: + - default container_name: hermes restart: always # Gateway run enables the internal API server on port 8642 diff --git a/ai/hermes/Dockerfile b/ai/hermes/Dockerfile index 6c8ddeb..042e1db 100644 --- a/ai/hermes/Dockerfile +++ b/ai/hermes/Dockerfile @@ -1,50 +1,59 @@ -# 1. On récupère la version la plus récente d'UV -FROM ghcr.io/astral-sh/uv:latest AS uv_source +# syntax=docker/dockerfile:1 +# Hermes Agent -- custom fork build +# Builds on top of official image + overlays our forked source from Gitea. +# Requires Docker BuildKit. Pass SSH agent for git clone: +# docker compose build hermes +# Or manually: +# DOCKER_BUILDKIT=1 docker build --ssh default -t hermes-agent:custom . -# 2. Image officielle Hermes Agent de NousResearch -# Contient déjà: Python, Node.js, npm, Playwright/Chromium, venv, tts_tool.py, etc. +# ---------- Base: official Hermes image (system deps, npm, uv, Playwright) ---------- FROM nousresearch/hermes-agent:latest -# ---------- System dependencies ---------- -# The official hermes-agent image already has: git, curl, ffmpeg, python3, -# gcc, build-essential, openssh-client, procps, tini, ripgrep, docker-cli, -# libportaudio2, ca-certificates, etc. -# -# These extras we need to add back: -# - poppler-utils, imagemagick (PDF/image processing) -# - texlive-* (LaTeX typesetting for reports) -# - qemu-user-static, binfmt-support (QEMU cross-compilation) -# - emacs-nox (text editing in container) +# ---------- Overlay our forked source ---------- +# Uses SSH agent forwarding from the build host (no key baked into image). +# --exclude node_modules/.venv keeps the base image's pre-built layers intact. +# Only the Python source, web UI source, and config change. +RUN --mount=type=ssh \ + mkdir -p /root/.ssh && \ + ssh-keyscan -p 2222 code.lazyworkhorse.net >> /root/.ssh/known_hosts 2>/dev/null && \ + cd /tmp && \ + GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \ + git clone --depth 1 --branch main \ + git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \ + rsync -a --delete fork/ /opt/hermes/ \ + --exclude node_modules \ + --exclude .venv \ + --exclude .git && \ + rm -rf /tmp/fork /root/.ssh/ + +# ---------- Rebuild web UI ---------- +# Source files changed; node_modules (from base image) reused. +RUN cd /opt/hermes && npm run build + +# ---------- Reinstall Python package (editable) ---------- +# Picks up source changes from our fork. +RUN . /opt/hermes/.venv/bin/activate && \ + uv pip install --no-cache-dir --no-deps -e /opt/hermes + +# ---------- Extra system deps ---------- USER root RUN apt-get update && \ apt-get install -y --no-install-recommends \ - libportaudio2 \ - ca-certificates \ - poppler-utils \ - imagemagick \ - texlive-latex-base \ - texlive-latex-extra \ - texlive-fonts-recommended \ - texlive-xetex \ - texlive-science \ - qemu-user-static \ - binfmt-support \ - emacs-nox && \ + libportaudio2 ca-certificates poppler-utils imagemagick \ + texlive-latex-base texlive-latex-extra texlive-fonts-recommended \ + texlive-xetex texlive-science \ + qemu-user-static binfmt-support emacs-nox && \ rm -rf /var/lib/apt/lists/* -# ---------- UV (hyperfast pip alternative) ---------- -COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/ +# ---------- UV ---------- +COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/ -WORKDIR /opt/hermes - -# ---------- Piper TTS dans le venv existant ---------- -# Le venv de l'image de base est root-owned, on doit installer en root aussi +# ---------- Piper TTS ---------- RUN . /opt/hermes/.venv/bin/activate && \ - uv pip install --no-cache-dir piper-tts sounddevice numpy + uv pip install --no-cache-dir piper-tts sounddevice numpy && \ + mkdir -p /opt/hermes/.venv/share/piper/voices -# ---------- Télécharger la voix Piper Ryan (high quality) ---------- -RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \ - /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF' +RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF' import urllib.request base = '/opt/hermes/.venv/share/piper/voices' url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx' @@ -52,22 +61,14 @@ urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx') urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json') PYEOF -# ---------- Patch tts_tool.py: remplacer Edge TTS par Piper ---------- -# Edge TTS appelle les serveurs Microsoft — on ne veut jamais ça. -# Piper roule localement sur CPU, aucun cloud, aucune donnée qui sort. -COPY patch_tts_tool.py /tmp/patch_tts_tool.py -RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py - # ---------- Runtime ---------- -# Retour à l'utilisateur non-root pour la sécurité USER hermes - ENV HERMES_HOME=/opt/data ENV PATH="/opt/data/.local/bin:${PATH}" +# Point browser tool to Playwright's Chromium (already in base image) +ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome VOLUME [ "/opt/data" ] -# Script de réparation des permissions + patch TTS au démarrage COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh - -ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ] +ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ] \ No newline at end of file diff --git a/versioncontrol/compose.yml b/versioncontrol/compose.yml index 7e7b54e..c4d7d67 100644 --- a/versioncontrol/compose.yml +++ b/versioncontrol/compose.yml @@ -9,6 +9,10 @@ services: - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net - SSH_PORT=2222 - SSH_LISTEN_PORT=2222 + # Enable Gitea Actions (act_runner required on host) + - GITEA__actions__ENABLED=true + # Don't fetch actions from GitHub (offline mode + local only) + - GITEA__actions__DEFAULT_ACTIONS_URL=off volumes: - /mnt/HoardingCow_docker_data/Gitea:/data networks: