feat: add OpenConcho web UI for Honcho (protege par Authelia)

ai/compose.yml

@@ -167,11 +167,13 @@ services:
     container_name: honcho
     restart: unless-stopped
     ports:
-      - "127.0.0.1:8000:8000"
+      - "127.0.0.1:8001:8000"
     environment:
       - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
       - CACHE_URL=redis://honcho-redis:6379/0
       - CACHE_ENABLED=true
+      - EMBEDDING_VECTOR_DIMENSIONS=1536
+      - VECTOR_STORE_DIMENSIONS=
     volumes:
       - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
     networks:
@@ -182,23 +184,32 @@ services:
         condition: service_healthy
       honcho-redis:
         condition: service_healthy
+
+  # --- OpenConcho: Honcho web UI ---
+  openconcho:
+    build: ./openconcho
+    container_name: openconcho
+    restart: unless-stopped
+    networks:
+      - ai_backend
+      - ai_net
     labels:
       - "traefik.enable=true"
 
       # Router for HTTP + redirect to HTTPS
-      - "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.honcho-http.entrypoints=web"
-      - "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.openconcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.openconcho-http.entrypoints=web"
+      - "traefik.http.routers.openconcho-http.middlewares=redirect-to-https"
 
       # Router for HTTPS with TLS — protected by Authelia
-      - "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.honcho-https.entrypoints=websecure"
-      - "traefik.http.routers.honcho-https.tls=true"
-      - "traefik.http.routers.honcho-https.tls.certresolver=njalla"
-      - "traefik.http.routers.honcho-https.middlewares=hermes-auth"
+      - "traefik.http.routers.openconcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.openconcho-https.entrypoints=websecure"
+      - "traefik.http.routers.openconcho-https.tls=true"
+      - "traefik.http.routers.openconcho-https.tls.certresolver=njalla"
+      - "traefik.http.routers.openconcho-https.middlewares=hermes-auth"
 
       # Service Loadbalancer
-      - "traefik.http.services.honcho.loadbalancer.server.port=8000"
+      - "traefik.http.services.openconcho.loadbalancer.server.port=80"
 
   honcho-db:
     image: pgvector/pgvector:pg15

ai/honcho/Dockerfile

@@ -17,9 +17,9 @@ WORKDIR /app
 
 ENV UV_COMPILE_BYTECODE=1
 ENV UV_LINK_MODE=copy
+ENV UV_PYTHON=/usr/local/bin/python3.13
 
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --frozen --no-group dev
+RUN uv sync --frozen
 
 # --- runtime stage ---
 FROM python:3.13-slim-bookworm
@@ -28,7 +28,6 @@ RUN groupadd --system app && \
     useradd --system --gid app --create-home app
 
 COPY --from=builder /app /app
-COPY --from=builder /root/.cache/uv /root/.cache/uv
 
 WORKDIR /app
 ENV PATH="/app/.venv/bin:$PATH"

ai/openconcho/Dockerfile

@@ -0,0 +1,23 @@
+# build stage
+FROM node:22-bookworm AS builder
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+ARG OPENCONCHO_SHA=e490d911fcb27ee193558fd9a28856cde2057665
+RUN git clone --depth 1 https://github.com/offendingcommit/openconcho.git /app && \
+    git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
+    git -C /app checkout ${OPENCONCHO_SHA}
+
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @openconcho/web build
+
+# runtime stage
+FROM nginx:alpine
+COPY --from=builder /app/packages/web/dist /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]