Compare commits

..

1 Commits

8 changed files with 239 additions and 324 deletions

112
ai/compose.yml Executable file → Normal file
View File

@@ -32,18 +32,13 @@ services:
- default
container_name: hermes
entrypoint: ["/bin/bash", "-c",
"bash /opt/data/hermes-tools/install.sh && bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
"bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
"hermes-entrypoint"]
restart: always
# Gateway run enables the internal API server on port 8642
command: gateway run
environment:
- OLLAMA_HOST=http://ollama:11434
- HERMES_DASHBOARD=1
# Multi-profile: comma-separated list of profiles to run as gateways.
# The entrypoint reads this and starts one gateway per profile.
# Add profiles here when they exist on disk (e.g. default,researcher,writer)
- HERMES_PROFILES=ashley,claire,finn,matt,paul
- API_SERVER_ENABLED=true
- API_SERVER_PORT=8642
- API_SERVER_HOST=0.0.0.0
@@ -71,32 +66,6 @@ services:
- "26"
networks:
- ai_backend
- ai_net
depends_on:
- honcho
labels:
- "traefik.enable=true"
- "traefik.docker.network=ai_net"
# Router for HTTP + redirection to HTTPS
- "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
- "traefik.http.routers.hermes-web-http.entrypoints=web"
- "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
# Router for HTTPS with TLS — protected by Authelia
- "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
- "traefik.http.routers.hermes-web-https.entrypoints=websecure"
- "traefik.http.routers.hermes-web-https.tls=true"
- "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
- "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
# Authelia forwardAuth
- "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
- "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
- "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
# Service Loadbalancer (dashboard port 9119)
- "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
syncthing:
image: syncthing/syncthing:latest
@@ -127,7 +96,6 @@ services:
- "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
- "traefik.http.services.syncthing.loadbalancer.server.port=8384"
ollama:
build:
context: ./ollama
@@ -161,84 +129,6 @@ services:
- "303"
- "26"
# --- Honcho: AI-native user modeling ---
honcho:
build: ./honcho
container_name: honcho
restart: unless-stopped
ports:
- "127.0.0.1:8000:8000"
environment:
- DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
- CACHE_URL=redis://honcho-redis:6379/0
- CACHE_ENABLED=true
volumes:
- /mnt/HoardingCow_docker_data/Honcho/data:/app/data
networks:
- ai_backend
- ai_net
depends_on:
honcho-db:
condition: service_healthy
honcho-redis:
condition: service_healthy
labels:
- "traefik.enable=true"
# Router for HTTP + redirect to HTTPS
- "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
- "traefik.http.routers.honcho-http.entrypoints=web"
- "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
# Router for HTTPS with TLS — protected by Authelia
- "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
- "traefik.http.routers.honcho-https.entrypoints=websecure"
- "traefik.http.routers.honcho-https.tls=true"
- "traefik.http.routers.honcho-https.tls.certresolver=njalla"
- "traefik.http.routers.honcho-https.middlewares=hermes-auth"
# Service Loadbalancer
- "traefik.http.services.honcho.loadbalancer.server.port=8000"
honcho-db:
image: pgvector/pgvector:pg15
container_name: honcho-db
restart: unless-stopped
ports:
- "127.0.0.1:5432:5432"
command: ["postgres", "-c", "max_connections=200"]
environment:
- POSTGRES_DB=honcho
- POSTGRES_USER=honcho
- POSTGRES_PASSWORD=honcho_pass
- PGDATA=/var/lib/postgresql/data/pgdata
volumes:
- /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
- ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
networks:
- ai_backend
healthcheck:
test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
interval: 5s
timeout: 5s
retries: 5
honcho-redis:
image: redis:8
container_name: honcho-redis
restart: unless-stopped
ports:
- "127.0.0.1:6379:6379"
volumes:
- /mnt/HoardingCow_docker_data/Honcho/redis:/data
networks:
- ai_backend
healthcheck:
test: ["CMD-SHELL", "redis-cli ping"]
interval: 5s
timeout: 5s
retries: 5
networks:
ai_net:
external: true

View File

@@ -0,0 +1,154 @@
#!/bin/bash
# ── Hermes Workspace Combined Entrypoint ──
# Waits for the Hermes gateway container (hermes:8642) to become healthy,
# then starts the Hermes Workspace web UI in the foreground.
# Supports graceful shutdown via SIGTERM/SIGINT.
# ──────────────────────────────────────────
set -euo pipefail
# ── Configuration ──────────────────────────────────────────────
GATEWAY_HOST="${GATEWAY_HOST:-hermes}"
GATEWAY_PORT="${GATEWAY_PORT:-8642}"
GATEWAY_URL="http://${GATEWAY_HOST}:${GATEWAY_PORT}"
HEALTH_ENDPOINT="${HEALTH_ENDPOINT:-/health}"
MAX_RETRIES="${HEALTH_MAX_RETRIES:-60}"
RETRY_INTERVAL="${HEALTH_RETRY_INTERVAL:-2}"
WORKSPACE_DIR="${WORKSPACE_DIR:-/workspace}"
WORKSPACE_ENTRY="${WORKSPACE_ENTRY:-server-entry.js}"
PID_FILE="${PID_FILE:-/tmp/workspace.pid}"
# ── Logging ────────────────────────────────────────────────────
log_info() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO] $*"; }
log_warn() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN] $*"; }
log_error() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $*"; }
# ── Graceful Shutdown ──────────────────────────────────────────
_workspace_pid=""
_shutting_down=false
cleanup() {
if [ "$_shutting_down" = true ]; then
return
fi
_shutting_down=true
log_info "Shutdown signal received, cleaning up..."
# Stop workspace process if running
if [ -n "$_workspace_pid" ] && kill -0 "$_workspace_pid" 2>/dev/null; then
log_info "Stopping workspace (PID: $_workspace_pid)..."
kill -TERM "$_workspace_pid" 2>/dev/null || true
# Give it time to shut down gracefully
local wait_sec=10
while kill -0 "$_workspace_pid" 2>/dev/null && [ "$wait_sec" -gt 0 ]; do
sleep 1
wait_sec=$((wait_sec - 1))
done
# Force kill if still running
if kill -0 "$_workspace_pid" 2>/dev/null; then
log_warn "Workspace did not shut down gracefully, force killing..."
kill -KILL "$_workspace_pid" 2>/dev/null || true
fi
fi
# Clean up PID file
[ -f "$PID_FILE" ] && rm -f "$PID_FILE"
log_info "Shutdown complete."
exit 0
}
# Trap termination signals for graceful shutdown
trap cleanup SIGTERM SIGINT
# ── Gateway Health Check ───────────────────────────────────────
wait_for_gateway() {
local url="${GATEWAY_URL}${HEALTH_ENDPOINT}"
local retries="$MAX_RETRIES"
local interval="$RETRY_INTERVAL"
local attempt=0
log_info "Waiting for Hermes gateway at ${GATEWAY_URL}..."
log_info "Max retries: ${retries}, interval: ${interval}s"
while [ "$attempt" -lt "$retries" ]; do
attempt=$((attempt + 1))
if curl -fsS "${url}" >/dev/null 2>&1; then
log_info "Gateway is healthy after ${attempt} attempt(s) (${GATEWAY_URL})"
return 0
fi
if [ "$attempt" -lt "$retries" ]; then
log_info "Gateway not ready yet (attempt ${attempt}/${retries}), retrying in ${interval}s..."
sleep "$interval"
fi
done
log_error "Gateway did not become healthy after ${retries} attempts ($((retries * interval))s)"
return 1
}
# ── Workspace Startup ──────────────────────────────────────────
start_workspace() {
local entry="${WORKSPACE_DIR}/${WORKSPACE_ENTRY}"
if [ ! -d "$WORKSPACE_DIR" ]; then
log_error "Workspace directory not found: ${WORKSPACE_DIR}"
return 1
fi
if [ ! -f "$entry" ]; then
log_error "Workspace entry point not found: ${entry}"
return 1
fi
log_info "Starting Hermes Workspace web UI..."
log_info " Directory: ${WORKSPACE_DIR}"
log_info " Entry: ${entry}"
cd "$WORKSPACE_DIR"
# Start workspace in background so we can trap signals
node --max-old-space-size=2048 "${entry}" &
_workspace_pid=$!
echo "$_workspace_pid" > "$PID_FILE"
log_info "Workspace started (PID: ${_workspace_pid})"
# Wait for workspace process
wait "$_workspace_pid"
local exit_code=$?
log_info "Workspace exited with code ${exit_code}"
return "$exit_code"
}
# ── Main ───────────────────────────────────────────────────────
main() {
log_info "=== Hermes Workspace Combined Entrypoint ==="
log_info "Gateway: ${GATEWAY_URL}"
log_info "Workspace: ${WORKSPACE_DIR}/${WORKSPACE_ENTRY}"
log_info "PID file: ${PID_FILE}"
# Wait for gateway to be healthy
if ! wait_for_gateway; then
log_warn "Proceeding without confirmed gateway health..."
fi
# Start the workspace
start_workspace
local exit_code=$?
log_info "Entrypoint exiting with code ${exit_code}"
return "$exit_code"
}
# Run main; exit with its return code
main "$@"

View File

@@ -20,10 +20,16 @@ RUN --mount=type=ssh \
GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
git clone --depth 1 --branch main \
git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
rm -rf fork/node_modules fork/.venv fork/.git && \
cp -a fork/. /opt/hermes/ && \
rsync -a --delete fork/ /opt/hermes/ \
--exclude node_modules \
--exclude .venv \
--exclude .git && \
rm -rf /tmp/fork /root/.ssh/
# ---------- Rebuild web UI ----------
# Source files changed; node_modules (from base image) reused.
RUN cd /opt/hermes && npm run build
# ---------- Reinstall Python package (editable) ----------
# Picks up source changes from our fork.
RUN . /opt/hermes/.venv/bin/activate && \
@@ -34,7 +40,6 @@ USER root
RUN apt-get update && \
apt-get install -y --no-install-recommends \
libportaudio2 ca-certificates poppler-utils imagemagick \
libolm-dev \
texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
texlive-xetex texlive-science \
qemu-user-static binfmt-support emacs-nox && \
@@ -43,20 +48,6 @@ RUN apt-get update && \
# ---------- UV ----------
COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
# ---------- Matrix bridge + extra pip deps ----------
# Previously installed inline at container startup and persisted via volume mount.
# Now baked into the image so the fragile venv volume mount can be removed.
RUN . /opt/hermes/.venv/bin/activate && \
uv pip install --no-cache-dir 'mautrix[encryption]' openai
WORKDIR /opt/hermes
# ---------- Matrix bridge + extra pip deps ----------
# Previously installed inline at container startup and persisted via volume mount.
# Now baked into the image so the fragile venv volume mount can be removed.
RUN . /opt/hermes/.venv/bin/activate && \
uv pip install --no-cache-dir 'mautrix[encryption]' openai
# ---------- Piper TTS ----------
RUN . /opt/hermes/.venv/bin/activate && \
uv pip install --no-cache-dir piper-tts sounddevice numpy && \
@@ -84,9 +75,9 @@ os.remove(tgz)
print('himalaya v1.2.0 installed')
PYEOF
# ---------- Install multi-gateway launcher ----------
# Launches one gateway process per profile (HERMES_PROFILES env var)
COPY --chmod=0755 run-multi-gateways.sh /usr/local/bin/run-multi-gateways.sh
# ---------- Install himalaya-ro wrapper ----------
COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
# ---------- Runtime ----------
USER hermes
@@ -97,7 +88,6 @@ ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
# Ensure tools directory and toolsets.py are writable by the hermes runtime user
# so custom tools can be injected from the persistent volume at startup.
USER root
RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
VOLUME [ "/opt/data" ]

73
ai/hermes/himalaya-ro.sh Normal file
View File

@@ -0,0 +1,73 @@
#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────
# himalaya-ro — Read-only wrapper for himalaya
#
# Blocks destructive commands and logs audit trail.
# Pass-through for read-only commands (list, read, search).
#
# Usage: himalaya-ro [options] <command> [args...]
#
# Install: place in PATH before the real himalaya, or use
# `ln -sf himalaya-ro /usr/local/bin/himalaya`
# ─────────────────────────────────────────────────────────────
set -o pipefail
# ── Configuration ───────────────────────────────────────────
HIMALAYA_BIN="${HIMALAYA_BIN:-/usr/local/bin/himalaya}"
AUDIT_LOG="${HIMALAYA_AUDIT_LOG:-/var/log/himalaya-audit.log}"
# ── Destructive commands we block ──────────────────────────
BLOCKED_CMDS=(
"message move"
"message delete"
"message copy"
"flag add"
"flag remove"
"folder create"
"folder delete"
"folder rename"
"template send"
"account configure"
"account delete"
)
# ── Determine the subcommand being invoked ─────────────────
# Strip leading options (--account, --output, etc.) to find the verb
ARGS=()
SKIP_NEXT=false
for arg in "$@"; do
if $SKIP_NEXT; then
SKIP_NEXT=false
continue
fi
if [[ "$arg" == --* ]]; then
case "$arg" in
--account|--output|--page|--page-size|--folder|--color|--format)
SKIP_NEXT=true ;;
esac
continue
fi
ARGS+=("$arg")
done
# Build subcommand string and check against blocklist
CMD_STR=""
for ((i=0; i<${#ARGS[@]}; i++)); do
if [ -z "$CMD_STR" ]; then
CMD_STR="${ARGS[$i]}"
else
CMD_STR="$CMD_STR ${ARGS[$i]}"
fi
for blocked in "${BLOCKED_CMDS[@]}"; do
if [[ "$CMD_STR" == "$blocked" ]]; then
TS=$(date '+%Y-%m-%d %H:%M:%S')
echo "[AUDIT] $TS BLOCKED: himalaya $*" >> "$AUDIT_LOG"
echo "ERROR: Command 'himalaya $CMD_STR ...' is blocked by read-only policy." >&2
echo " Audit log: $AUDIT_LOG" >&2
exit 100
fi
done
done
# ── Allow pass-through ─────────────────────────────────────
exec "$HIMALAYA_BIN" "$@"

View File

@@ -1,32 +0,0 @@
#!/bin/bash
# Multi-gateway launcher for HERMES_PROFILES env var.
# Reads comma-separated profile names, spawns one gateway per profile.
# Designed to run before the main entrypoint — gateways run in background.
set -e
if [ -z "${HERMES_PROFILES}" ]; then
echo "HERMES_PROFILES not set — skipping multi-gateway launch"
exit 0
fi
# Source venv to make 'hermes' available (entrypoint.sh sources it later,
# but we need it NOW for the background gateways)
HERMES_BIN="/opt/hermes/.venv/bin/hermes"
if [ ! -x "$HERMES_BIN" ]; then
echo "ERROR: hermes binary not found at $HERMES_BIN"
exit 1
fi
mkdir -p /opt/data/logs
IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
for profile in "${PROFILES[@]}"; do
profile="$(echo "${profile}" | xargs)" # trim whitespace
[ -z "${profile}" ] && continue
echo "Starting gateway for profile: ${profile}"
nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
>> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
done
echo "All gateways launched: ${HERMES_PROFILES}"

View File

@@ -1,42 +0,0 @@
# build stage — fetches and builds Honcho from source
# Using buildkit cache mounts for speed across rebuilds
FROM python:3.13-slim-bookworm AS builder
RUN apt-get update && \
apt-get install -y --no-install-recommends git && \
rm -rf /var/lib/apt/lists/*
COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
# Clone Honcho at a pinned commit for reproducibility
ARG HONCHO_REPO=https://github.com/plastic-labs/honcho
ARG HONCHO_REF=main
RUN git clone --depth 1 --branch ${HONCHO_REF} ${HONCHO_REPO} /app
WORKDIR /app
ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy
RUN --mount=type=cache,target=/root/.cache/uv \
uv sync --frozen --no-group dev
# --- runtime stage ---
FROM python:3.13-slim-bookworm
RUN groupadd --system app && \
useradd --system --gid app --create-home app
COPY --from=builder /app /app
COPY --from=builder /root/.cache/uv /root/.cache/uv
WORKDIR /app
ENV PATH="/app/.venv/bin:$PATH"
ENV HOME=/app
COPY --chown=app:app config.toml /app/config.toml
USER app
EXPOSE 8000
CMD ["fastapi", "run", "--host", "0.0.0.0", "src/main.py"]

View File

@@ -1,117 +0,0 @@
[app]
LOG_LEVEL = "INFO"
MAX_MESSAGE_SIZE = 25000
EMBED_MESSAGES = true
NAMESPACE = "honcho"
[db]
CONNECTION_URI = "postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho"
SCHEMA = "public"
POOL_SIZE = 10
MAX_OVERFLOW = 20
[auth]
USE_AUTH = false
[sentry]
ENABLED = false
[telemetry]
ENABLED = false
[webhook]
ENABLED = false
[cache]
ENABLED = true
URL = "redis://honcho-redis:6379/0"
[llm]
DEFAULT_MAX_TOKENS = 4096
# Embeddings via Ollama (nomic-embed-text recommended on this system)
[embedding]
VECTOR_DIMENSIONS = 768
MAX_INPUT_TOKENS = 8192
[embedding.model_config]
transport = "openai"
model = "nomic-embed-text"
base_url = "http://ollama:11434/v1"
# --- Deriver (user representation builder) ---
[deriver]
ENABLED = true
WORKERS = 1
POLLING_SLEEP_INTERVAL_SECONDS = 5.0
FLUSH_ENABLED = true
[deriver.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
# --- Dialectic ---
[dialectic]
MAX_INPUT_TOKENS = 4096
SESSION_HISTORY_MAX_TOKENS = 8192
[dialectic.levels.minimal]
MAX_TOOL_ITERATIONS = 1
MAX_OUTPUT_TOKENS = 512
[dialectic.levels.minimal.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
[dialectic.levels.low]
MAX_TOOL_ITERATIONS = 3
[dialectic.levels.low.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
[dialectic.levels.medium]
MAX_TOOL_ITERATIONS = 2
[dialectic.levels.medium.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
[dialectic.levels.high]
MAX_TOOL_ITERATIONS = 4
[dialectic.levels.high.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
[dialectic.levels.max]
MAX_TOOL_ITERATIONS = 10
[dialectic.levels.max.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
# --- Summary ---
[summary]
ENABLED = true
MESSAGES_PER_SHORT_SUMMARY = 20
MESSAGES_PER_LONG_SUMMARY = 60
[summary.model_config]
transport = "openai"
model = "hermes-3"
base_url = "http://ollama:11434/v1"
# --- Dream ---
[dream]
ENABLED = false
# --- Peer Card ---
[peer_card]
ENABLED = true
# --- Vector Store ---
[vector_store]
TYPE = "pgvector"
DIMENSIONS = 768

View File

@@ -1 +0,0 @@
CREATE EXTENSION IF NOT EXISTS vector;