From 71db97f78cfa55c1f70c84ef324c18a2f0a2e484 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@lazyworkhorse.net>
Date: Fri, 22 May 2026 23:40:34 -0400
Subject: [PATCH] feat: add OpenConcho web UI for Honcho (protege par Authelia)

---
 ai/compose.yml           | 26 ++++++++++++++++++++++++++
 ai/openconcho/Dockerfile | 23 +++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 ai/openconcho/Dockerfile

diff --git a/ai/compose.yml b/ai/compose.yml
index 8c30336..d844774 100755
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -185,6 +185,32 @@ services:
       honcho-redis:
         condition: service_healthy
 
+  # --- OpenConcho: Honcho web UI ---
+  openconcho:
+    build: ./openconcho
+    container_name: openconcho
+    restart: unless-stopped
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+
+      # Router for HTTP + redirect to HTTPS
+      - "traefik.http.routers.openconcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.openconcho-http.entrypoints=web"
+      - "traefik.http.routers.openconcho-http.middlewares=redirect-to-https"
+
+      # Router for HTTPS with TLS — protected by Authelia
+      - "traefik.http.routers.openconcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.openconcho-https.entrypoints=websecure"
+      - "traefik.http.routers.openconcho-https.tls=true"
+      - "traefik.http.routers.openconcho-https.tls.certresolver=njalla"
+      - "traefik.http.routers.openconcho-https.middlewares=hermes-auth"
+
+      # Service Loadbalancer
+      - "traefik.http.services.openconcho.loadbalancer.server.port=80"
+
   honcho-db:
     image: pgvector/pgvector:pg15
     container_name: honcho-db
diff --git a/ai/openconcho/Dockerfile b/ai/openconcho/Dockerfile
new file mode 100644
index 0000000..de9ed48
--- /dev/null
+++ b/ai/openconcho/Dockerfile
@@ -0,0 +1,23 @@
+# build stage
+FROM node:22-bookworm AS builder
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+ARG OPENCONCHO_SHA=e490d911fcb27ee193558fd9a28856cde2057665
+RUN git clone --depth 1 https://github.com/offendingcommit/openconcho.git /app && \
+    git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
+    git -C /app checkout ${OPENCONCHO_SHA}
+
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @openconcho/web build
+
+# runtime stage
+FROM nginx:alpine
+COPY --from=builder /app/packages/web/dist /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]