fix: add user directive to hermes service

- Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build
- Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs
- Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings)

Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.

ai/compose.yml

@@ -31,6 +31,7 @@ services:
       ssh:
         - default
     container_name: hermes
+    user: "10000:10000"
     entrypoint: ["/bin/bash", "-c",
       "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
       "hermes-entrypoint"]
@@ -54,6 +55,10 @@ services:
       - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -63,6 +68,35 @@ services:
     networks:
       - ai_backend
 
+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
   ollama:
     build:
       context: ./ollama
@@ -79,78 +113,7 @@ services:
       - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
     environment:
       - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
       - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=1
-      - OLLAMA_NUM_PARALLEL=2
-    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-
-  paperclip-db:
-    image: postgres:17-alpine
-    container_name: paperclip-db
-    restart: always
-    environment:
-      POSTGRES_USER: paperclip
-      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
-      POSTGRES_DB: paperclip
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-    volumes:
-      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
-    networks:
-      - ai_backend
-
-  paperclip:
-    build:
-      context: ./paperclip
-    container_name: paperclip
-    restart: always
-    ports:
-      - "127.0.0.1:3100:3100"
-    environment:
-      - HOST=0.0.0.0
-      - PORT=3100
-      - SERVE_UI=true
-      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
-      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
-      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
-      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
-      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
-    volumes:
-      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
-    depends_on:
-      paperclip-db:
-        condition: service_healthy
-    networks:
-      - ai_net
-      - ai_backend
-    labels:
-      - "traefik.enable=true"
-
-      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
-      - "traefik.http.routers.paperclip-http.entrypoints=web"
-      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
-
-      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
-      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
-      - "traefik.http.routers.paperclip-https.tls=true"
-      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
-
-      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
 
 networks:
   ai_net:
@@ -160,47 +123,40 @@ networks:
     driver: bridge
     name: ai_backend
     
-  # llama_cpp_devstral:
+  llama-cpp-hermes:
-  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
+    image: llama-cpp:rocm-gfx906
-  #   container_name: llama_cpp_devstral
+    container_name: llama-cpp-hermes
-  #   restart: unless-stopped
+    restart: unless-stopped
-  #   networks:
+    networks:
-  #     - ai_backend
+      - ai_backend
-  #   ports:
+    ports:
-  #     - "8300:8080"
+      - "127.0.0.1:8300:8080"
-  #   ipc: host
+    ipc: host
-  #   devices:
+    devices:
-  #     - "/dev/kfd:/dev/kfd"
+      - /dev/kfd:/dev/kfd
-  #     - "/dev/dri:/dev/dri"
+      - /dev/dri:/dev/dri
-  #   group_add:
+    group_add:
-  #     - "303" # video
+      - "303"
-  #     - "26"  # render
+      - "26"
-  #   environment:
+    environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-  #     HIP_VISIBLE_DEVICES: 0,1
+      - HSA_ENABLE_SDMA=0
-  #     LLAMA_CACHE: /models
+      - HIP_VISIBLE_DEVICES=0,1
-  #   volumes:
+      - LLAMA_CACHE=/models
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+    volumes:
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
+      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-  #   command: >
+      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
+    command: >
-  #     -a devstral-2-small-llama_cpp
+      -m /model.gguf
-  #     --chat-template-file /template.jinja
+      --host 0.0.0.0
-  #     --host 0.0.0.0
+      --port 8080
-  #     --port 8080
+      --gpu-layers 99
-  #     --n-gpu-layers 99
+      --ctx-size 163840
-  #     --ctx-size 163840
+      -ctk f16 -ctv f16
-  #     --batch-size 4096
+      --flash-attn on
-  #     --ubatch-size 4096
+      --split-mode layer
-  #     --cache-type-k f16
+      --no-mmap
-  #     --cache-type-v f16
+      --n-predict -1
-  #     --cache-reuse 256
-  #     --flash-attn on
-  #     --context-shift
-  #     --split-mode layer
-  #     --no-mmap
-  #     --n-predict -1
-  #     --parallel 2
 
   # vllm:
   #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3

ai/llama-cpp/Dockerfile

@@ -0,0 +1,30 @@
+# llama-cpp-rocm6/Dockerfile
+# Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
+# Build: docker build -t llama-cpp:rocm-gfx906 .
+
+FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
+ARG LLAMACPP_VERSION=b9596
+RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
+WORKDIR /build
+ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm
+RUN mkdir build && cd build && \
+    cmake .. -DGGML_HIP=ON -DCMAKE_BUILD_TYPE=Release \
+      -DAMDGPU_TARGETS="gfx906:xnack-" \
+      -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+      -DGGML_CUDA=OFF -DGGML_VULKAN=OFF -DGGML_METAL=OFF \
+      -DBUILD_SHARED_LIBS=OFF && \
+    cmake --build . --target llama-server -- -j $(nproc)
+
+FROM ubuntu:24.04
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates curl libstdc++6 libgomp1 libopenblas0 \
+    libnuma1 libelf1 libdrm2 libdrm-amdgpu1 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
+COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
+COPY --from=builder /build/build/bin/llama-server /usr/local/bin/llama-server
+RUN echo /opt/rocm/lib > /etc/ld.so.conf.d/rocm.conf && ldconfig
+ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 HCC_AMDGPU_TARGET=gfx906 HSA_ENABLE_SDMA=0
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/llama-server"]

ai/paperclip/Dockerfile

@@ -1,47 +0,0 @@
-# syntax=docker/dockerfile:1.20
-FROM ghcr.io/paperclipai/paperclip:v2026.517.0
-
-# ── Install Hermes adapter npm package into seed directory ──────────
-# This seed data gets copied to the persistent volume on first boot
-# so the adapter is available without network access.
-USER root
-
-RUN npm install --no-save --prefix /opt/paperclip-seed/adapter-plugins \
-    hermes-paperclip-adapter@0.3.0
-
-# Create adapter-plugins.json metadata (Paperclip reads this on startup
-# to discover which external adapters to load)
-RUN mkdir -p /opt/paperclip-seed && python3 -c "
-import json
-record = {
-    'packageName': 'hermes-paperclip-adapter',
-    'version': '0.3.0',
-    'type': 'hermes',
-    'installedAt': '2026-05-18T00:00:00.000Z',
-}
-with open('/opt/paperclip-seed/adapter-plugins.json', 'w') as f:
-    json.dump([record], f, indent=2)
-"
-
-# Ensure the adapter-plugins dir has a package.json (Paperclip expects one)
-RUN python3 -c "
-import json
-pkg = {
-    'name': 'paperclip-adapter-plugins',
-    'version': '0.0.0',
-    'private': True,
-    'description': 'Managed directory for Paperclip external adapter plugins.',
-}
-with open('/opt/paperclip-seed/adapter-plugins/package.json', 'w') as f:
-    json.dump(pkg, f, indent=2)
-"
-
-# ── Custom entrypoint ──────────────────────────────────────────────
-# Seeds the Hermes adapter on fresh volumes, then runs original logic.
-COPY docker-entrypoint.sh /usr/local/bin/paperclip-entrypoint.sh
-RUN chmod +x /usr/local/bin/paperclip-entrypoint.sh
-
-USER node
-
-ENTRYPOINT ["/usr/local/bin/paperclip-entrypoint.sh"]
-CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]

ai/paperclip/docker-entrypoint.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-set -e
-
-# ── Seed Hermes adapter if volume is fresh ──────────────────────────
-PAPERCLIP_HOME="${PAPERCLIP_HOME:-/paperclip}"
-if [ ! -f "${PAPERCLIP_HOME}/adapter-plugins.json" ]; then
-    echo "[paperclip] Seeding Hermes adapter plugin..."
-    cp -r /opt/paperclip-seed/* "${PAPERCLIP_HOME}/"
-    chown -R "${USER_UID:-1000}:${USER_GID:-1000}" \
-        "${PAPERCLIP_HOME}/adapter-plugins" \
-        "${PAPERCLIP_HOME}/adapter-plugins.json"
-    echo "[paperclip] Hermes adapter seeded. Ready to create Hermes agents."
-fi
-
-# ── Original entrypoint logic (UID/GID adjustment) ──────────────────
-PUID="${USER_UID:-1000}"
-PGID="${USER_GID:-1000}"
-changed=0
-
-if [ "$(id -u node)" -ne "$PUID" ]; then
-    usermod -o -u "$PUID" node
-    changed=1
-fi
-
-if [ "$(id -g node)" -ne "$PGID" ]; then
-    groupmod -o -g "$PGID" node
-    usermod -g "$PGID" node
-    changed=1
-fi
-
-if [ "$changed" = "1" ]; then
-    chown -R node:node "${PAPERCLIP_HOME}"
-fi
-
-exec gosu node "$@"