- Remove patch_tts_tool.py (orphaned)
- Remove run-multi-gateways.sh (replaced by s6 native profile supervision)
- Remove start-hermes.sh (overengineered — the image does this natively)
- compose.yml: command: gateway run, drop HERMES_PROFILES env var
- Dockerfile: revert start-hermes.sh COPY addition
Per-profile gateways are now managed by s6-overlay natively:
profiles with desired_state=running in gateway_state.json are
auto-started by the s6 reconciler on boot.
- New start-hermes.sh: multi-profile launcher that works with s6-overlay's
main-program model (replaces bash->tini->entrypoint.sh chain)
- Dockerfile: COPY start-hermes.sh into /usr/local/bin/ alongside
run-multi-gateways.sh (which is now unused but kept for reference)
- compose.yml: remove entrypoint override, CMD now points at
/usr/local/bin/start-hermes.sh via the image default ENTRYPOINT
Fixes the SIGTERM crash loop caused by S6_CMD_ARG0 being unset when the
deprecated entrypoint.sh shim bypassed s6-overlay's /init.
- Install gosu in hermes image so run-multi-gateways.sh can drop
privileges when USER hermes is set at the end of the Dockerfile.
- Add openssh-client + ssh-keyscan to the openconcho-builder stage
so SSH host key verification passes during the first Gitea clone.
The Dockerfile was switching to USER root for the final chown but never
switched back to USER hermes. This caused ALL container processes to run
as root (uid 0) instead of the hermes user (uid 10000).
The entrypoint's gosu privilege drop only caught the main exec chain,
leaving backgrounded subprocesses (dashboard PTY sessions, workers with
start_new_session=True) running as root — creating files owned by root
in ExoKortex and breaking Syncthing sync.
Adding USER hermes at the end ensures the container runs unprivileged
and ALL child processes inherit uid 10000 from the start.
- Add OpenViking service (knowledge graph) using official GHCR image
- Add Honcho stack (user modeling): API + PostgreSQL pgvector + Redis
- Add Holographic config to Hermes (local SQLite, no server needed)
- Hermes: install httpx for OpenViking client
- Hermes: auto-generate config.yaml + honcho.json on first boot
- All data 100% local, zero cloud dependencies
- Add libolm-dev system dep (required by mautrix[encryption])
- Add mautrix[encryption] + openai pip packages to build
- These were previously installed inline at container startup and
persisted via the fragile venv volume mount (now removed)
The chown -R hermes:hermes was running as non-root user 'hermes'
since USER hermes was set earlier. The new upstream base image
(v0.12.0+) has tools/ owned by root, so the chown fails.
Previous base image happened to have tools/ owned by hermes,
making the chown a silent no-op.
- Replace rsync with cp -a (rsync unavailable in latest upstream base image)
- Remove npm run build step (fork's package.json has no build script)
- Remove himalaya-ro.sh from build context (deployed via install.sh)
- Add hermes to ai_net network for Traefik access
- Add Traefik labels routing hermes.lazyworkhorse.net to dashboard port 9119
- Switch Dockerfile to clone from gortium/hermes-agent (Gitea fork)
- Add SSH agent forwarding for private repo clone at build time
- Set CHROME_EXECUTABLE for Playwright Chromium
- Remove patch_tts_tool.py (Piper patch now in fork source)
- Enable Gitea Actions in versioncontrol compose
