fix: add gosu to hermes + ssh host key to honcho builder

Hermes: install gosu package so run-multi-gateways.sh's gosu hermes
drop works when USER hermes is set in Dockerfile.

Honcho: add openssh-client + ssh-keyscan to openconcho-builder stage
so SSH host key verification passes during Gitea clone on first build.

ai/compose.yml

@@ -1,90 +1,113 @@
 services:
+
   hermes:
     build:
       context: ./hermes
+      ssh:
+        - default
     container_name: hermes
+    entrypoint: ["/bin/bash", "-c",
+      "bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "hermes-entrypoint"]
     restart: always
+    # Gateway run enables the internal API server on port 8642
     command: gateway run
     environment:
-    - HERMES_UID=10000
+      - HERMES_UID=10000
-    - HERMES_GID=10000
+      - HERMES_GID=10000
-    - OLLAMA_HOST=http://ollama-cpu:11434
+      - OLLAMA_HOST=http://ollama-cpu:11434
-    - HERMES_DASHBOARD=1
+      - HERMES_DASHBOARD=1
-    - API_SERVER_ENABLED=true
+      # Multi-profile: comma-separated list of profiles to run as gateways.
-    - API_SERVER_PORT=8642
+      # The entrypoint reads this and starts one gateway per profile.
-    - API_SERVER_HOST=0.0.0.0
+      # Add profiles here when they exist on disk (e.g. default,researcher,writer)
-    - API_SERVER_KEY=hermes_local_key
+      - HERMES_PROFILES=ashley,claire,finn,matt,paul
-    - GATEWAY_ALLOW_ALL_USERS=true
+      - API_SERVER_ENABLED=true
-    - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      - API_SERVER_PORT=8642
-    - OPENCODE_API_KEY=${OPENCODE_API_KEY}
+      - API_SERVER_HOST=0.0.0.0
-    - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - API_SERVER_KEY=hermes_local_key
-    - HCC_AMDGPU_TARGET=gfx906
+      - GATEWAY_ALLOW_ALL_USERS=true
-    - HIP_VISIBLE_DEVICES=0,1
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-    - ROCR_VISIBLE_DEVICES=0,1
+      - OPENCODE_API_KEY=${OPENCODE_API_KEY}
-    - HSA_ENABLE_SDMA=0
+      # ROCm for GPU-accelerated faster-whisper STT
-    - TZ=America/Montreal
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0
+      - TZ=America/Montreal
     volumes:
-    - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
     devices:
-    - /dev/kfd:/dev/kfd
+      - /dev/kfd:/dev/kfd
-    - /dev/dri:/dev/dri
+      - /dev/dri:/dev/dri
     group_add:
-    - '303'
+      - "303"
-    - '26'
+      - "26"
     networks:
-      ai_backend: null
+      - ai_backend
-      ai_net: null
+      - ai_net
-      vpn_net:
-        ipv4_address: 172.24.0.5
     depends_on:
-    - honcho
+      - honcho
     labels:
-    - traefik.enable=true
+      - "traefik.enable=true"
-    - traefik.docker.network=ai_net
+      - "traefik.docker.network=ai_net"
-    - traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)
+
-    - traefik.http.routers.hermes-web-http.entrypoints=web
+      # Router for HTTP + redirection to HTTPS
-    - traefik.http.routers.hermes-web-http.middlewares=redirect-to-https
+      - "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
-    - traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)
+      - "traefik.http.routers.hermes-web-http.entrypoints=web"
-    - traefik.http.routers.hermes-web-https.entrypoints=websecure
+      - "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
-    - traefik.http.routers.hermes-web-https.tls=true
+
-    - traefik.http.routers.hermes-web-https.tls.certresolver=njalla
+      # Router for HTTPS with TLS — protected by Authelia
-    - traefik.http.routers.hermes-web-https.middlewares=hermes-auth
+      - "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
-    - traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/
+      - "traefik.http.routers.hermes-web-https.entrypoints=websecure"
-    - traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true
+      - "traefik.http.routers.hermes-web-https.tls=true"
-    - traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups
+      - "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
-    - traefik.http.services.hermes-web.loadbalancer.server.port=9119
+      - "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
+
+      # Authelia forwardAuth
+      - "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
+      - "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
+      - "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
+
+      # Service Loadbalancer (dashboard port 9119)
+      - "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
+
   syncthing:
     image: syncthing/syncthing:latest
     container_name: syncthing
     hostname: syncthing
     restart: always
     ports:
-    - 8384:8384
+      - "8384:8384"
-    - 22000:22000
+      - "22000:22000"
-    - 21027:21027/udp
+      - "21027:21027/udp"
     environment:
-    - TZ=America/Montreal
+      - TZ=America/Montreal
-    - PUID=10000
+      - PUID=10000
-    - PGID=10000
+      - PGID=10000
     volumes:
-    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
-    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
     networks:
-    - ai_backend
+      - ai_backend
-    - ai_net
+      - ai_net
     labels:
-    - traefik.enable=true
+      - "traefik.enable=true"
-    - traefik.docker.network=ai_net
+      - "traefik.docker.network=ai_net"
-    - traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)
+
-    - traefik.http.routers.syncthing-http.entrypoints=web
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
-    - traefik.http.routers.syncthing-http.middlewares=redirect-to-https
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
-    - traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-    - traefik.http.routers.syncthing-https.entrypoints=websecure
+
-    - traefik.http.routers.syncthing-https.tls=true
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
-    - traefik.http.routers.syncthing-https.tls.certresolver=njalla
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-    - traefik.http.routers.syncthing-https.middlewares=hermes-auth
+      - "traefik.http.routers.syncthing-https.tls=true"
-    - traefik.http.services.syncthing.loadbalancer.server.port=8384
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.routers.syncthing-https.middlewares=hermes-auth"
+
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
   ollama-cpu:
     build:
       context: ./ollama
@@ -92,110 +115,126 @@ services:
     image: ollama/ollama:rocm-gfx906
     container_name: ollama-cpu
     tty: true
-    restart: always
+    restart: always 
     ports:
-    - 127.0.0.1:11434:11434
+      - "127.0.0.1:11434:11434"
     networks:
-    - ai_backend
+      - ai_backend
     volumes:
-    - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
     environment:
-    - OLLAMA_VULKAN=0
+      - OLLAMA_VULKAN=0
-    - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_HOST=0.0.0.0
+
   llama-cpp-hermes:
     image: llama-cpp:rocm-gfx906
     container_name: llama-cpp-hermes
     restart: unless-stopped
     networks:
-    - ai_backend
+      - ai_backend
     ports:
-    - 127.0.0.1:8300:8080
+      - "127.0.0.1:8300:8080"
     ipc: host
     devices:
-    - /dev/kfd:/dev/kfd
+      - /dev/kfd:/dev/kfd
-    - /dev/dri:/dev/dri
+      - /dev/dri:/dev/dri
     group_add:
-    - '303'
+      - "303"
-    - '26'
+      - "26"
     environment:
-    - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-    - HSA_ENABLE_SDMA=0
+      - HSA_ENABLE_SDMA=0
-    - HIP_VISIBLE_DEVICES=0,1
+      - HIP_VISIBLE_DEVICES=0,1
-    - LLAMA_CACHE=/models
+      - LLAMA_CACHE=/models
     volumes:
-    - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-    - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
+      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-    command: '-m /model.gguf --host 0.0.0.0 --port 8080 --gpu-layers 99 --ctx-size
+    command: >
-      163840 -ctk f16 -ctv f16 --flash-attn on --split-mode layer --no-mmap --n-predict
+      -m /model.gguf
-      -1
+      --host 0.0.0.0
+      --port 8080
+      --gpu-layers 99
+      --ctx-size 163840
+      -ctk f16 -ctv f16
+      --flash-attn on
+      --split-mode layer
+      --no-mmap
+      --n-predict -1
 
-      '
+  # --- Honcho + OpenConcho combiné: API + Web UI nginx/FastAPI ---
   honcho:
     build:
       context: ./honcho
       ssh:
-      - default
+        - default
     container_name: honcho
     restart: unless-stopped
     environment:
-    - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
+      - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
-    - CACHE_URL=redis://honcho-redis:6379/0
+      - CACHE_URL=redis://honcho-redis:6379/0
-    - CACHE_ENABLED=true
+      - CACHE_ENABLED=true
-    - EMBEDDING_VECTOR_DIMENSIONS=1024
+      - EMBEDDING_VECTOR_DIMENSIONS=1024
-    - AUTH_USE_AUTH=true
+      - AUTH_USE_AUTH=true
-    - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
+      - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
-    - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
+      # Needed by deriver/dream to make LLM calls (api_key_env = "HONCHO_OPENAI_API_KEY" in config.toml)
+      - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
     volumes:
-    - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
+      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
-    - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
+      - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
     networks:
-    - ai_backend
+      - ai_backend
-    - ai_net
+      - ai_net
     labels:
-    - traefik.enable=true
+      - "traefik.enable=true"
-    - traefik.docker.network=ai_net
+      - "traefik.docker.network=ai_net"
-    - traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)
+
-    - traefik.http.routers.honcho-http.entrypoints=web
+      # Router for HTTP + redirect to HTTPS
-    - traefik.http.routers.honcho-http.middlewares=redirect-to-https
+      - "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
-    - traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)
+      - "traefik.http.routers.honcho-http.entrypoints=web"
-    - traefik.http.routers.honcho-https.entrypoints=websecure
+      - "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
-    - traefik.http.routers.honcho-https.tls=true
+
-    - traefik.http.routers.honcho-https.tls.certresolver=njalla
+      # Router for HTTPS with TLS — protected by Authelia
-    - traefik.http.routers.honcho-https.middlewares=hermes-auth
+      - "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
-    - traefik.http.services.honcho.loadbalancer.server.port=80
+      - "traefik.http.routers.honcho-https.entrypoints=websecure"
+      - "traefik.http.routers.honcho-https.tls=true"
+      - "traefik.http.routers.honcho-https.tls.certresolver=njalla"
+      - "traefik.http.routers.honcho-https.middlewares=hermes-auth"
+
+      # Service Loadbalancer (nginx port)
+      - "traefik.http.services.honcho.loadbalancer.server.port=80"
     depends_on:
-    - honcho-db
+      - honcho-db
-    - honcho-redis
+      - honcho-redis
+
   honcho-db:
     image: pgvector/pgvector:pg15
     container_name: honcho-db
     restart: unless-stopped
     ports:
-    - 127.0.0.1:5432:5432
+      - "127.0.0.1:5432:5432"
-    command:
+    command: ["postgres", "-c", "max_connections=200"]
-    - postgres
-    - -c
-    - max_connections=200
     environment:
-    - POSTGRES_DB=honcho
+      - POSTGRES_DB=honcho
-    - POSTGRES_USER=honcho
+      - POSTGRES_USER=honcho
-    - POSTGRES_PASSWORD=honcho_pass
+      - POSTGRES_PASSWORD=honcho_pass
-    - PGDATA=/var/lib/postgresql/data/pgdata
+      - PGDATA=/var/lib/postgresql/data/pgdata
     volumes:
-    - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
+      - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
-    - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
+      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
     networks:
-    - ai_backend
+      - ai_backend
+
   honcho-redis:
     image: redis:8
     container_name: honcho-redis
     restart: unless-stopped
     ports:
-    - 127.0.0.1:6379:6379
+      - "127.0.0.1:6379:6379"
     volumes:
-    - /mnt/HoardingCow_docker_data/Honcho/redis:/data
+      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
     networks:
-    - ai_backend
+      - ai_backend
+
 networks:
   ai_net:
     driver: bridge
@@ -203,10 +242,193 @@ networks:
   ai_backend:
     driver: bridge
     name: ai_backend
-  vpn_net:
+
-    external: true
-    name: vpn_net
 volumes:
   honcho_data:
     driver: bridge
     name: honcho_data
+    
+  # vllm:
+  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
+  #   container_name: vllm
+  #   # Required for multi-GPU communication (NCCL)
+  #   ipc: host 
+  #   init: true
+  #   shm_size: '2g' 
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8000"
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303"
+  #     - "26"
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HSA_ENABLE_SDMA: 0
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     NCCL_P2P_DISABLE: 1
+  #     VLLM_WORKER_MULTIPROC_METHOD: spawn
+  #     VLLM_USE_TRITON_FLASH_ATTN: 0
+  #     VLLM_USE_ROCM_CUSTOM_PAGED_ATTN: 0
+  #     VLLM_ATTENTION_BACKEND: ROPE_NAIVE
+  #     VLLM_SKIP_WARMUP: 1
+  #     VLLM_USE_V1: 0
+  #     HF_TOKEN: ${HF_TOKEN}
+  #   command: >
+  #     vllm serve "mistralai/Devstral-Small-2-24B-Instruct-2512" 
+  #     --tensor-parallel-size 2
+  #     --max-model-len 8192
+  #     --gpu-memory-utilization 0.90
+  #     --tokenizer_mode mistral
+  #     --config_format auto
+  #     --load-format auto
+  #     --enforce-eager
+  #     --disable-custom-all-reduce
+  #     --trust-remote-code
+  #     --task generate
+  #     --block-size 16
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
+  #   restart: unless-stopped
+
+  # webui:
+  #   image: ghcr.io/open-webui/open-webui:main
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
+  # n8n:
+  #   image: n8nio/n8n:latest
+  #   container_name: n8n
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_net
+  #   environment:
+  #     - N8N_HOST=n8n.lazyworkhorse.net
+  #     - N8N_PORT=5678
+  #     - N8N_PROTOCOL=https
+  #     - NODE_ENV=production
+  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
+  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
+  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
+  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
+  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
+  #     - N8N_NATIVE_PYTHON_RUNNER=true
+  #     - N8N_PYTHON_ALLOW_STDLIB=uuid,re,os,json
+  #     - N8N_PYTHON_ALLOW_EXTERNAL=requests,pandas
+  #     - NODE_FUNCTION_ALLOW_EXTERNAL=uuid,requests
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/n8n:/home/node/.n8n
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-http.entrypoints=web"
+  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
+  #     - "traefik.http.routers.n8n-https.tls=true"
+  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
+
+  #     # Service Loadbalancer (n8n default port)
+  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+  # openclaw:
+  #   image: coollabsio/openclaw:latest
+  #   container_name: openclaw
+  #   restart: unless-stopped
+  #   expose:
+  #     - "8080"  # WebUI
+  #     - "18789" # Gateway/WebSocket
+  #     - "8788"  # Nextcloud Webhook
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
+  #     - /home/gortium/infra:/data/workspace/infra
+  #   environment:
+  #     - TZ=America/Toronto
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     # Point to the sidecar browser
+  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
+  #     - BROWSER_EVALUATE_ENABLED=true
+  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
+
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.priority=50"
+  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #     - "traefik.http.routers.openclaw-https.tls=true"
+  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   depends_on:
+  #     - openclaw-browser
+
+  # openclaw-browser:
+  #   image: ghcr.io/browserless/chromium:latest
+  #   restart: always
+  #   expose:
+  #     - "3000"
+  #   environment:
+  #     - MAX_CONCURRENT_SESSIONS=10
+  #     - CONNECTION_TIMEOUT=300000
+  #     - PREBOOT_CHROME=true
+  #     - DEMO_MODE=false
+  #   networks:
+  #     ai_backend:
+  #       aliases:
+  #         - browser
+
+  # openclaw-ssh:
+  #   image: linuxserver/openssh-server:latest
+  #   container_name: openclaw-ssh
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
+  #     - SUDO_ACCESS=false
+  #     - PASSWORD_ACCESS=false
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
+  #     - /home/gortium/infra:/data/workspace/infra:ro
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
+  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
+  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
+  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"

ai/hermes/Dockerfile

@@ -59,6 +59,10 @@ os.remove(tgz)
 print('himalaya v1.2.0 installed')
 PYEOF
 
+# ---------- Install multi-gateway launcher ----------
+# Launches one gateway process per profile (HERMES_PROFILES env var)
+COPY --chmod=0755 run-multi-gateways.sh /usr/local/bin/run-multi-gateways.sh
+
 # ---------- Runtime ----------
 USER hermes
 ENV HERMES_HOME=/opt/data

ai/hermes/patch_tts_tool.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
+
+Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
+
+Searches multiple paths for tts_tool.py so it works both at build time
+(in the image venv) and at runtime (on the mounted data volume).
+
+Idempotent: if already patched, does nothing.
+"""
+
+import sys
+import os
+
+# ---------------------------------------------------------------------------
+# Search for all copies of tts_tool.py
+# ---------------------------------------------------------------------------
+CANDIDATE_PATHS = [
+    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
+    "/opt/hermes/tools/tts_tool.py",
+]
+
+found_paths = []
+
+for p in CANDIDATE_PATHS:
+    if os.path.exists(p):
+        found_paths.append(p)
+        print(f"Found tts_tool.py at: {p}")
+
+# Also try to find via Python import
+import subprocess
+try:
+    result = subprocess.run(
+        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
+        capture_output=True, text=True, timeout=5
+    )
+    if result.returncode == 0:
+        p = result.stdout.strip()
+        if os.path.exists(p) and p not in found_paths:
+            found_paths.append(p)
+            print(f"Found tts_tool.py via import at: {p}")
+except Exception:
+    pass
+
+if not found_paths:
+    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
+    print(f"Searched: {CANDIDATE_PATHS}")
+    sys.exit(0)
+
+# ---------------------------------------------------------------------------
+# Old else block: the Edge TTS default fallback to replace
+# ---------------------------------------------------------------------------
+old_else = '''        else:
+            # Default: Edge TTS (free), with NeuTTS as local fallback
+            edge_available = True
+            try:
+                _import_edge_tts()
+            except ImportError:
+                edge_available = False
+
+            if edge_available:
+                logger.info("Generating speech with Edge TTS...")
+                try:
+                    import concurrent.futures
+                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                        pool.submit(
+                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+                        ).result(timeout=60)
+                except RuntimeError:
+                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+            elif _check_neutts_available():
+                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
+                provider = "neutts"
+                _generate_neutts(text, file_str, tts_config)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
+                             "or set up NeuTTS for local synthesis."
+                }, ensure_ascii=False)'''
+
+# ---------------------------------------------------------------------------
+# New block: elif provider == "piper" + else: fallback with Piper only
+# ---------------------------------------------------------------------------
+new_block = '''        elif provider == "piper":
+            # Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if not os.path.exists(model_path):
+                return json.dumps({
+                    "success": False,
+                    "error": "Piper TTS voice model not found. "
+                             "Install Piper TTS and download a voice model."
+                }, ensure_ascii=False)
+            logger.info("Generating speech with Piper TTS (local, CPU)...")
+            import subprocess as _sp
+            cmd = [piper_binary, "--model", model_path, "--output-raw"]
+            try:
+                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
+                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                if proc.returncode != 0:
+                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+            except Exception as e:
+                return json.dumps({
+                    "success": False,
+                    "error": f"Piper TTS failed: {e}"
+                }, ensure_ascii=False)
+
+        else:
+            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if os.path.exists(model_path) and os.path.exists(piper_binary):
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess as _sp
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                try:
+                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
+                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                    if proc.returncode != 0:
+                        raise RuntimeError(stderr.decode()[:200])
+                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                except Exception:
+                    pass
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
+                }, ensure_ascii=False)'''
+
+# ---------------------------------------------------------------------------
+# Apply the patch to all copies found
+# ---------------------------------------------------------------------------
+patched_any = False
+
+for tts_path in found_paths:
+    with open(tts_path) as f:
+        code = f.read()
+
+    if 'provider == "piper"' in code:
+        print(f"ALREADY PATCHED: {tts_path}")
+        continue
+
+    if old_else in code:
+        code = code.replace(old_else, new_block, 1)
+        with open(tts_path, 'w') as f:
+            f.write(code)
+        print(f"PATCHED: {tts_path}")
+        patched_any = True
+    else:
+        print(f"SKIP {tts_path}: Edge fallback pattern not found")
+        import re
+        for m in re.finditer(r'        else:\n            # Default:', code):
+            start = max(0, m.start() - 100)
+            end = min(len(code), m.end() + 300)
+            print(f"  Found 'else:/# Default:' at position {m.start()}:")
+            print(f"  {code[start:end]}")
+            print("  ---")
+        # Don't exit with error — if one copy isn't patchable, try the others
+
+if not patched_any:
+    all_patched = all(
+        'provider == "piper"' in open(p).read()
+        for p in found_paths
+    )
+    if all_patched:
+        print("All copies already patched.")
+        sys.exit(0)
+    print("WARNING: Could not patch any copy of tts_tool.py")
+    sys.exit(1)
+
+print("tts_tool.py patched successfully across all copies.")

ai/hermes/run-multi-gateways.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Multi-gateway launcher for HERMES_PROFILES env var.
+# Reads comma-separated profile names, spawns one gateway per profile.
+# Designed to run before the main entrypoint — gateways run in background.
+set -e
+
+if [ -z "${HERMES_PROFILES}" ]; then
+  echo "HERMES_PROFILES not set — skipping multi-gateway launch"
+  exit 0
+fi
+
+# Source venv to make 'hermes' available (entrypoint.sh sources it later,
+# but we need it NOW for the background gateways)
+HERMES_BIN="/opt/hermes/.venv/bin/hermes"
+if [ ! -x "$HERMES_BIN" ]; then
+  echo "ERROR: hermes binary not found at $HERMES_BIN"
+  exit 1
+fi
+
+mkdir -p /opt/data/logs
+
+IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
+for profile in "${PROFILES[@]}"; do
+  profile="$(echo "${profile}" | xargs)"  # trim whitespace
+  [ -z "${profile}" ] && continue
+
+  echo "Starting gateway for profile: ${profile}"
+  nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
+      >> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
+done
+
+echo "All gateways launched: ${HERMES_PROFILES}"

ai/honcho/Dockerfile

@@ -30,7 +30,7 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 RUN apt-get update && apt-get install -y git openssh-client && rm -rf /var/lib/apt/lists/**
 
-ARG OPENCONCHO_SHA=148766312e6a5256f399c64171854f0ff6173b6d
+ARG OPENCONCHO_SHA=3b5c3293fc18d768dbe85285264a8d66c896bd81
 RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan -p 2222 code.lazyworkhorse.net >> ~/.ssh/known_hosts 2>/dev/null
 RUN --mount=type=ssh git clone --depth 1 ssh://git@code.lazyworkhorse.net:2222/gortium/openconcho.git /app && \
     git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \