feat: add Hermes Workspace alongside existing Hermes Agent

- Add HERMES_DASHBOARD=1 env vars to existing hermes service
  (enables multi-agent dashboard API on port 9119)
- Add healthcheck to hermes service (required for workspace dep)
- Add hermes-workspace service (ghcr.io/outsourc-e/hermes-workspace:latest)
  - Connects to existing gateway at hermes:8642 and dashboard at hermes:9119
  - Shares Hermes data volume for config/sessions/skills/memory
  - Exposed via Traefik at workspace.lazyworkhorse.net (port 3000)
  - Requires HERMES_WORKSPACE_PASSWORD in .env (agenix)
- Networks: ai_backend + ai_net (for Traefik)

ai/compose.yml

@@ -31,6 +31,9 @@ services:
       ssh:
         - default
     container_name: hermes
+    entrypoint: ["/bin/bash", "-c",
+      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
     command: gateway run
@@ -49,8 +52,16 @@ services:
       - ROCR_VISIBLE_DEVICES=0,1
       - HSA_ENABLE_SDMA=0
       - TZ=America/Montreal
+      # Hermes Workspace dashboard (port 9119) — enables multi-agent web UI
+      - HERMES_DASHBOARD=1
+      - HERMES_DASHBOARD_HOST=0.0.0.0
+      - HERMES_DASHBOARD_PORT=9119
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -59,6 +70,41 @@ services:
       - "26"
     networks:
       - ai_backend
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8642/health && curl -fsS http://localhost:9119/api/status || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+
+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
 
   ollama:
     build:
@@ -93,6 +139,46 @@ services:
       - "303"
       - "26"
 
+  # ── Hermes Workspace ──────────────────────────────────────────
+  # Web UI for Hermes Agent — chat, memory, skills, terminal,
+  # multi-agent swarm orchestration. Connects to the existing
+  # hermes gateway (port 8642) and dashboard (port 9119).
+  hermes-workspace:
+    image: ghcr.io/outsourc-e/hermes-workspace:latest
+    container_name: hermes-workspace
+    restart: unless-stopped
+    depends_on:
+      hermes:
+        condition: service_healthy
+    environment:
+      HERMES_API_URL: http://hermes:8642
+      HERMES_DASHBOARD_URL: http://hermes:9119
+      HERMES_API_TOKEN: ${API_SERVER_KEY}
+      HERMES_PASSWORD: ${HERMES_WORKSPACE_PASSWORD:?must be set}
+      COOKIE_SECURE: "1"
+    volumes:
+      # Share the same Hermes data — workspace reads config, sessions,
+      # skills, memory from the agent's persistent volume
+      - /mnt/HoardingCow_docker_data/Hermes/data:/home/workspace/.hermes
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
+      - "traefik.http.routers.workspace-http.rule=Host(`workspace.lazyworkhorse.net`)"
+      - "traefik.http.routers.workspace-http.entrypoints=web"
+      - "traefik.http.routers.workspace-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.workspace-https.rule=Host(`workspace.lazyworkhorse.net`)"
+      - "traefik.http.routers.workspace-https.entrypoints=websecure"
+      - "traefik.http.routers.workspace-https.tls=true"
+      - "traefik.http.routers.workspace-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.workspace.loadbalancer.server.port=3000"
+# ─────────────────────────────────────────────────────────────
+
 networks:
   ai_net:
     external: true

ai/hermes/Dockerfile

@@ -1,34 +1,52 @@
-# 1. On récupère la version la plus récente d'UV
-FROM ghcr.io/astral-sh/uv:latest AS uv_source
+# syntax=docker/dockerfile:1
+# Hermes Agent -- custom fork build
+# Builds on top of official image + overlays our forked source from Gitea.
+# Requires Docker BuildKit. Pass SSH agent for git clone:
+#   docker compose build hermes
+# Or manually:
+#   DOCKER_BUILDKIT=1 docker build --ssh default -t hermes-agent:custom .
 
-# 2. Image officielle Hermes Agent de NousResearch
-# Contient déjà: Python, Node.js, npm, Playwright/Chromium, venv, tts_tool.py, etc.
+# ---------- Base: official Hermes image (system deps, npm, uv, Playwright) ----------
 FROM nousresearch/hermes-agent:latest
 
-# ---------- System dependencies ----------
-# The official hermes-agent image already has: git, curl, ffmpeg, python3,
-# gcc, build-essential, openssh-client, procps, tini, ripgrep, docker-cli,
-# libportaudio2, ca-certificates, etc.
+# ---------- Overlay our forked source ----------
+# Uses SSH agent forwarding from the build host (no key baked into image).
+# --exclude node_modules/.venv keeps the base image's pre-built layers intact.
+# Only the Python source, web UI source, and config change.
+RUN --mount=type=ssh \
+    mkdir -p /root/.ssh && \
+    ssh-keyscan -p 2222 code.lazyworkhorse.net >> /root/.ssh/known_hosts 2>/dev/null && \
+    cd /tmp && \
+    GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
+    git clone --depth 1 --branch main \
+    git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
+    rsync -a --delete fork/ /opt/hermes/ \
+      --exclude node_modules \
+      --exclude .venv \
+      --exclude .git && \
+    rm -rf /tmp/fork /root/.ssh/
+
+# ---------- Rebuild web UI ----------
+# Source files changed; node_modules (from base image) reused.
+RUN cd /opt/hermes && npm run build
+
+# ---------- Reinstall Python package (editable) ----------
+# Picks up source changes from our fork.
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir --no-deps -e /opt/hermes
+
+# ---------- Extra system deps ----------
 USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        poppler-utils \
-        imagemagick \
-        texlive-latex-base \
-        texlive-latex-extra \
-        texlive-fonts-recommended \
-        texlive-xetex \
-        texlive-science && \
+        libportaudio2 ca-certificates poppler-utils imagemagick \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
+        texlive-xetex texlive-science \
+        qemu-user-static binfmt-support emacs-nox && \
     rm -rf /var/lib/apt/lists/*
 
-# ---------- UV (hyperfast pip alternative) ----------
-COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
-
-WORKDIR /opt/hermes
-
-# ---------- Extra Python deps ----------
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir httpx
+# ---------- UV ----------
+COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
 
 # ---------- Piper TTS ----------
 RUN . /opt/hermes/.venv/bin/activate && \
@@ -41,7 +59,6 @@ base = '/opt/hermes/.venv/share/piper/voices'
 url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
 urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
 urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
-print('Piper voice downloaded')
 PYEOF
 
 # ---------- Install Himalaya email CLI ----------
@@ -61,11 +78,6 @@ PYEOF
 # ---------- Install himalaya-ro wrapper ----------
 COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
 
-# ---------- Patch tts_tool.py: remplacer Edge TTS par Piper ----------
-# Edge TTS appelle les serveurs Microsoft — on ne veut jamais ça.
-# Piper roule localement sur CPU, aucun cloud, aucune donnée qui sort.
-COPY patch_tts_tool.py /tmp/patch_tts_tool.py
-RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
 
 # ---------- Runtime ----------
 USER hermes
@@ -74,9 +86,8 @@ ENV PATH="/opt/data/.local/bin:${PATH}"
 # Point browser tool to Playwright's Chromium (already in base image)
 ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
 
-VOLUME [ "/opt/data" ]
+# Ensure tools directory and toolsets.py are writable by the hermes runtime user
+# so custom tools can be injected from the persistent volume at startup.
+RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
 
-# Startup permission fix + config generation + TTS patch
-COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
-
-ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]
+VOLUME [ "/opt/data" ]

ai/hermes/fix-permissions.sh

@@ -1,38 +0,0 @@
-#!/bin/bash
-# Startup permission fix + TTS patch.
-# Runs as root before the entrypoint drops to the hermes user.
-set -e
-
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
-
-# Fix ownership on critical writable directories
-chown -R hermes:hermes \
-  "$HERMES_HOME/sessions" \
-  "$HERMES_HOME/checkpoints" \
-  "$HERMES_HOME/skills" \
-  "$HERMES_HOME/memories" \
-  "$HERMES_HOME/workspace" \
-  "$HERMES_HOME/pastes" \
-  "$HERMES_HOME/logs" \
-  "$HERMES_HOME/cron" \
-  "$HERMES_HOME/plans" \
-  "$HERMES_HOME/hooks" \
-  "$HERMES_HOME/cache" \
-  2>/dev/null || true
-
-# Fix data volume root ownership
-if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
-  chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
-fi
-
-# ---------- Patch tts_tool.py: replace Edge TTS with Piper ----------
-# Fallback runtime patch in case the volume's site-packages differ from the image.
-# Idempotent: if already patched, the script does nothing.
-PATCH_SCRIPT="/opt/hermes/patch_tts_tool.py"
-if [ -f "$PATCH_SCRIPT" ]; then
-  echo "Applying TTS patch (Piper only, no Edge fallback)..."
-  /opt/hermes/.venv/bin/python3 "$PATCH_SCRIPT" 2>&1 || true
-fi
-
-# Chain to the official Hermes entrypoint
-exec /opt/hermes/docker/entrypoint.sh "$@"

versioncontrol/compose.yml

@@ -8,13 +8,10 @@ services:
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
       - GITEA__actions__ENABLED=true
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
       # Enable Gitea Actions (act_runner required on host)
       - GITEA__actions__ENABLED=true
-      # Don't fetch actions from GitHub (offline mode + local only)
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks:

vpn/Dockerfile

@@ -0,0 +1,9 @@
+# Custom wg-easy with iptables-nft (nftables-backed iptables)
+# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
+FROM ghcr.io/wg-easy/wg-easy:latest
+
+# The upstream image registers only iptables-legacy with update-alternatives.
+# iptables-nft binary exists but isn't registered as an alternative key.
+# Override the alternatives-managed symlinks directly.
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables

vpn/compose.yml

@@ -2,7 +2,10 @@ version: "3.8"
 
 services:
   wireguard:
-    image: weejewel/wg-easy:latest
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: wg-easy-iptables-nft:latest
     container_name: wireguard
     cap_add:
       - NET_ADMIN