From 5e8d669a2cfcb1b189ab9af35aa29cd38da9a270 Mon Sep 17 00:00:00 2001
From: Thierry Pouplier <thierrypouplier@gmail.com>
Date: Fri, 18 Sep 2026 15:54:23 -0400
Subject: [PATCH] hermes: add supervised dashboard-cathou service (:9120, own
 identity). Second s6 service reusing the main dashboard machinery, mounted
 read-only; env injected in compose. Runs the command directly to dodge the
 with-contenv env reset that would collapse it to the main service identity.

---
 ai/compose.yml                             |  3 +++
 ai/s6/dashboard-cathou/dependencies.d/base |  1 +
 ai/s6/dashboard-cathou/finish              |  4 ++++
 ai/s6/dashboard-cathou/run                 | 17 +++++++++++++++++
 ai/s6/dashboard-cathou/type                |  1 +
 5 files changed, 26 insertions(+)
 create mode 100644 ai/s6/dashboard-cathou/dependencies.d/base
 create mode 100644 ai/s6/dashboard-cathou/finish
 create mode 100644 ai/s6/dashboard-cathou/run
 create mode 100644 ai/s6/dashboard-cathou/type

diff --git a/ai/compose.yml b/ai/compose.yml
index fa4c744..647a105 100755
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -23,9 +23,12 @@ services:
     - ROCR_VISIBLE_DEVICES=0,1
     - HSA_ENABLE_SDMA=0
     - TZ=America/Montreal
+    - CATHOU_SERVE_PASSWORD=${CATHOU_SERVE_PASSWORD:?must be set}
+    - CATHOU_SERVE_SECRET=${CATHOU_SERVE_SECRET:?must be set}
     volumes:
     - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
+    - ./s6/dashboard-cathou:/etc/s6-overlay/s6-rc.d/dashboard-cathou:ro
     devices:
     - /dev/kfd:/dev/kfd
     - /dev/dri:/dev/dri
diff --git a/ai/s6/dashboard-cathou/dependencies.d/base b/ai/s6/dashboard-cathou/dependencies.d/base
new file mode 100644
index 0000000..8681f8b
--- /dev/null
+++ b/ai/s6/dashboard-cathou/dependencies.d/base
@@ -0,0 +1 @@
+base
\ No newline at end of file
diff --git a/ai/s6/dashboard-cathou/finish b/ai/s6/dashboard-cathou/finish
new file mode 100644
index 0000000..1729eeb
--- /dev/null
+++ b/ai/s6/dashboard-cathou/finish
@@ -0,0 +1,4 @@
+#!/command/with-contenv sh
+# Always restart on exit (exit != 125). Crash-loop with a bad auth
+# config is the intended fail-closed signal.
+exit 0
\ No newline at end of file
diff --git a/ai/s6/dashboard-cathou/run b/ai/s6/dashboard-cathou/run
new file mode 100644
index 0000000..c2c9427
--- /dev/null
+++ b/ai/s6/dashboard-cathou/run
@@ -0,0 +1,17 @@
+#!/command/with-contenv sh
+# Personal dashboard serve (:9120) for cathou — same machinery as the
+# main dashboard service, but runs the command directly so its OWN
+# with-contenv shebang can't wipe our env (a second with-contenv reset
+# would drop the port + auth variables). Supervised by s6: restarts on crash.
+export HERMES_DASHBOARD_PORT=9120
+export HERMES_DASHBOARD_BASIC_AUTH_USERNAME=cathou
+export HERMES_DASHBOARD_BASIC_AUTH_PASSWORD="${CATHOU_SERVE_PASSWORD:-}"
+export HERMES_DASHBOARD_BASIC_AUTH_SECRET="${CATHOU_SERVE_SECRET:-}"
+export HOME=/opt/data
+cd /opt/data
+# shellcheck disable=SC1091
+. /opt/hermes/.venv/bin/activate
+# Fail-closed: missing password => provider won't register => serve fails
+# => s6 crash-loop surfaces it, never a silent unauthenticated bind.
+[ "$(id -u)" = 0 ] || exec hermes dashboard --host 0.0.0.0 --port 9120 --no-open
+exec s6-setuidgid hermes hermes dashboard --host 0.0.0.0 --port 9120 --no-open
\ No newline at end of file
diff --git a/ai/s6/dashboard-cathou/type b/ai/s6/dashboard-cathou/type
new file mode 100644
index 0000000..1780f9f
--- /dev/null
+++ b/ai/s6/dashboard-cathou/type
@@ -0,0 +1 @@
+longrun
\ No newline at end of file