fix(paperclip): force Traefik to use ai_net network for routing

The Hermes adapter can be installed once via Paperclip's adapter
management API and persists on the Docker volume across restarts.
No custom Dockerfile or build step required.

ai/compose.yml

@@ -52,16 +52,8 @@ services:
       - ROCR_VISIBLE_DEVICES=0,1
       - HSA_ENABLE_SDMA=0
       - TZ=America/Montreal
-      # Hermes Workspace dashboard (port 9119) — enables multi-agent web UI
-      - HERMES_DASHBOARD=1
-      - HERMES_DASHBOARD_HOST=0.0.0.0
-      - HERMES_DASHBOARD_PORT=9119
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      # Syncthing-shared org files — read-only view of user's agenda
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
-      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -70,65 +62,6 @@ services:
       - "26"
     networks:
       - ai_backend
-      - ai_net
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=ai_net"
-
-      # Router for HTTP + redirect to HTTPS
-      - "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
-      - "traefik.http.routers.hermes-web-http.entrypoints=web"
-      - "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
-
-      # Router for HTTPS with TLS — protected by Authelia
-      - "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
-      - "traefik.http.routers.hermes-web-https.entrypoints=websecure"
-      - "traefik.http.routers.hermes-web-https.tls=true"
-      - "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
-      - "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
-
-      # Authelia forwardAuth
-      - "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
-
-      # Service Loadbalancer (dashboard port 9119)
-      - "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
-    healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://localhost:8642/health && curl -fsS http://localhost:9119/api/status || exit 1"]
-      interval: 15s
-      timeout: 5s
-      retries: 5
-      start_period: 60s
-
-  syncthing:
-    image: syncthing/syncthing:latest
-    container_name: syncthing
-    hostname: syncthing
-    restart: always
-    ports:
-      - "8384:8384"
-      - "22000:22000"
-      - "21027:21027/udp"
-    environment:
-      - TZ=America/Montreal
-    volumes:
-      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
-    networks:
-      - ai_backend
-      - ai_net
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.tls=true"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
-      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
 
   ollama:
     build:
@@ -163,45 +96,61 @@ services:
       - "303"
       - "26"
 
-  # ── Hermes Workspace (combined image) ────────────────────────
-  # Web UI + Swarm worker support. Uses custom combined image with
-  # our Hermes fork + workspace web UI + tmux for Swarm workers.
-  hermes-workspace:
-    build:
-      context: ./hermes-workspace
-      ssh:
-        - default
-    container_name: hermes-workspace
-    restart: unless-stopped
-    depends_on:
-      hermes:
-        condition: service_healthy
+  paperclip-db:
+    image: postgres:17-alpine
+    container_name: paperclip-db
+    restart: always
     environment:
-      HERMES_API_URL: http://hermes:8642
-      HERMES_DASHBOARD_URL: http://hermes:9119
-      HERMES_API_TOKEN: hermes_local_key
-      HERMES_PASSWORD: ${HERMES_WORKSPACE_PASSWORD:?must be set}
-      COOKIE_SECURE: "1"
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
     volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
     networks:
       - ai_backend
+
+  paperclip:
+    image: ghcr.io/paperclipai/paperclip:v2026.517.0
+    container_name: paperclip
+    restart: always
+    ports:
+      - "127.0.0.1:3100:3100"
+    environment:
+      - HOST=0.0.0.0
+      - PORT=3100
+      - SERVE_UI=true
+      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
+      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
+      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
+      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
+    depends_on:
+      paperclip-db:
+        condition: service_healthy
+    networks:
       - ai_net
+      - ai_backend
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=ai_net"
 
-      - "traefik.http.routers.workspace-http.rule=Host(`workspace.lazyworkhorse.net`)"
-      - "traefik.http.routers.workspace-http.entrypoints=web"
-      - "traefik.http.routers.workspace-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-http.entrypoints=web"
+      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
 
-      - "traefik.http.routers.workspace-https.rule=Host(`workspace.lazyworkhorse.net`)"
-      - "traefik.http.routers.workspace-https.entrypoints=websecure"
-      - "traefik.http.routers.workspace-https.tls=true"
-      - "traefik.http.routers.workspace-https.tls.certresolver=njalla"
+      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
+      - "traefik.http.routers.paperclip-https.tls=true"
+      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
 
-      - "traefik.http.services.workspace.loadbalancer.server.port=3000"
-# ─────────────────────────────────────────────────────────────
+      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
 
 networks:
   ai_net:

ai/hermes-workspace/Dockerfile

@@ -1,129 +0,0 @@
-# syntax=docker/dockerfile:1
-# Hermes Agent + Hermes Workspace — combined image
-# Builds on top of official image + our forked source + workspace UI.
-# Supports Swarm Mode (tmux workers) in a single container.
-# Requires Docker BuildKit. Pass SSH agent for git clone:
-#   docker compose build hermes-workspace
-
-# ---------- Stage 1: Build Hermes Workspace (web UI) ----------
-FROM node:22-slim AS workspace-build
-
-WORKDIR /app
-
-# Install pnpm and git
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates git curl \
-    && rm -rf /var/lib/apt/lists/* \
-    && corepack enable
-
-# Clone workspace source (pinned to a known-good commit on main)
-RUN git clone --depth 1 --branch main \
-    https://github.com/outsourc-e/hermes-workspace.git /app/workspace-src \
-    && rm -rf /app/workspace-src/.git
-
-WORKDIR /app/workspace-src
-
-# Install deps and build
-RUN pnpm install --frozen-lockfile && pnpm build
-
-# ---------- Stage 2: Hermes Agent + Workspace runtime ----------
-FROM nousresearch/hermes-agent:latest
-
-# ---------- Install tmux for Swarm workers + curl for health checks ----------
-# Note: Node.js is already shipped with the base hermets-agent image; apt's nodejs
-# would be older and could conflict. Only add what's missing.
-USER root
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    tmux curl \
-    && rm -rf /var/lib/apt/lists/*
-
-# ---------- Overlay our forked Hermes source ----------
-RUN --mount=type=ssh \
-    mkdir -p /root/.ssh && \
-    ssh-keyscan -p 2222 code.lazyworkhorse.net >> /root/.ssh/known_hosts 2>/dev/null && \
-    cd /tmp && \
-    GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
-    git clone --depth 1 --branch main \
-    git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
-    rsync -a --delete fork/ /opt/hermes/ \
-      --exclude node_modules \
-      --exclude .venv \
-      --exclude .git && \
-    rm -rf /tmp/fork /root/.ssh/
-
-# ---------- Rebuild web UI ----------
-RUN cd /opt/hermes && npm run build
-
-# ---------- Reinstall Python package ----------
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir --no-deps -e /opt/hermes
-
-# ---------- Extra system deps ----------
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libportaudio2 ca-certificates poppler-utils imagemagick \
-    texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
-    texlive-xetex texlive-science \
-    qemu-user-static binfmt-support emacs-nox \
-    && rm -rf /var/lib/apt/lists/*
-
-# ---------- UV ----------
-COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
-
-# ---------- Piper TTS ----------
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir piper-tts sounddevice numpy && \
-    mkdir -p /opt/hermes/.venv/share/piper/voices
-
-RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import urllib.request
-base = '/opt/hermes/.venv/share/piper/voices'
-url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
-urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
-urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
-PYEOF
-
-# ---------- Install Himalaya email CLI ----------
-RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import urllib.request, tarfile, os, shutil
-url = 'https://github.com/pimalaya/himalaya/releases/download/v1.2.0/himalaya.x86_64-linux.tgz'
-tgz = '/tmp/himalaya.tgz'
-urllib.request.urlretrieve(url, tgz)
-with tarfile.open(tgz) as t:
-    t.extractall('/tmp')
-shutil.move('/tmp/himalaya', '/usr/local/bin/himalaya')
-os.chmod('/usr/local/bin/himalaya', 0o755)
-os.remove(tgz)
-print('himalaya v1.2.0 installed')
-PYEOF
-
-# ---------- Install himalaya-ro wrapper ----------
-COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
-
-# ---------- Copy Hermes Workspace build artifacts ----------
-COPY --from=workspace-build --chown=hermes:hermes \
-    /app/workspace-src/dist /workspace/dist
-COPY --from=workspace-build --chown=hermes:hermes \
-    /app/workspace-src/node_modules /workspace/node_modules
-COPY --from=workspace-build --chown=hermes:hermes \
-    /app/workspace-src/package.json /workspace/
-COPY --from=workspace-build --chown=hermes:hermes \
-    /app/workspace-src/server-entry.js /workspace/
-COPY --from=workspace-build --chown=hermes:hermes \
-    /app/workspace-src/skills /workspace/skills
-COPY --chmod=0755 entrypoint-combined.sh /usr/local/bin/entrypoint-combined.sh
-
-# ---------- Runtime ----------
-USER hermes
-ENV HERMES_HOME=/opt/data
-ENV PATH="/opt/data/.local/bin:${PATH}"
-ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
-ENV HOST=0.0.0.0
-ENV NODE_ENV=production
-
-RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
-
-VOLUME [ "/opt/data" ]
-
-EXPOSE 8642 9119 3000
-
-ENTRYPOINT ["/usr/bin/tini", "-g", "--", "/usr/local/bin/entrypoint-combined.sh"]

ai/hermes-workspace/entrypoint-combined.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -e
-
-# ── Hermes Workspace + Swarm Worker Entrypoint ──
-# Starts Hermes Workspace web UI (port 3000) and makes
-# hermes CLI + tmux available for Swarm workers.
-# The Hermes gateway runs in a separate container (hermes:8642).
-# Swarm workers spawned here connect to the gateway via HTTP.
-# ──────────────────────────────────────────────────────────
-
-# Install custom tools from persistent volume
-if [ -f /opt/data/hermes-tools/install.sh ]; then
-  bash /opt/data/hermes-tools/install.sh || true
-fi
-
-# Wait for Hermes gateway to be healthy before starting workspace
-if [ -n "${HERMES_API_URL:-}" ]; then
-  echo "Waiting for Hermes gateway..."
-  for i in $(seq 1 30); do
-    if curl -fsS "${HERMES_API_URL}/health" >/dev/null 2>&1; then
-      echo "Gateway healthy after ${i}s"
-      break
-    fi
-    if [ "$i" -eq 30 ]; then
-      echo "WARNING: Gateway not healthy after 30s, starting workspace anyway"
-    fi
-    sleep 1
-  done
-fi
-
-# Start Hermes Workspace in foreground
-cd /workspace
-exec node --max-old-space-size=2048 server-entry.js

ai/hermes-workspace/himalaya-ro.sh

@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────
-# himalaya-ro — Read-only wrapper for himalaya
-#
-# Blocks destructive commands and logs audit trail.
-# Pass-through for read-only commands (list, read, search).
-#
-# Usage:  himalaya-ro [options] <command> [args...]
-#
-# Install: place in PATH before the real himalaya, or use
-#          `ln -sf himalaya-ro /usr/local/bin/himalaya`
-# ─────────────────────────────────────────────────────────────
-set -o pipefail
-
-# ── Configuration ───────────────────────────────────────────
-HIMALAYA_BIN="${HIMALAYA_BIN:-/usr/local/bin/himalaya}"
-AUDIT_LOG="${HIMALAYA_AUDIT_LOG:-/var/log/himalaya-audit.log}"
-
-# ── Destructive commands we block ──────────────────────────
-BLOCKED_CMDS=(
-  "message move"
-  "message delete"
-  "message copy"
-  "flag add"
-  "flag remove"
-  "folder create"
-  "folder delete"
-  "folder rename"
-  "template send"
-  "account configure"
-  "account delete"
-)
-
-# ── Determine the subcommand being invoked ─────────────────
-# Strip leading options (--account, --output, etc.) to find the verb
-ARGS=()
-SKIP_NEXT=false
-for arg in "$@"; do
-  if $SKIP_NEXT; then
-    SKIP_NEXT=false
-    continue
-  fi
-  if [[ "$arg" == --* ]]; then
-    case "$arg" in
-      --account|--output|--page|--page-size|--folder|--color|--format)
-        SKIP_NEXT=true ;;
-    esac
-    continue
-  fi
-  ARGS+=("$arg")
-done
-
-# Build subcommand string and check against blocklist
-CMD_STR=""
-for ((i=0; i<${#ARGS[@]}; i++)); do
-  if [ -z "$CMD_STR" ]; then
-    CMD_STR="${ARGS[$i]}"
-  else
-    CMD_STR="$CMD_STR ${ARGS[$i]}"
-  fi
-  for blocked in "${BLOCKED_CMDS[@]}"; do
-    if [[ "$CMD_STR" == "$blocked" ]]; then
-      TS=$(date '+%Y-%m-%d %H:%M:%S')
-      echo "[AUDIT] $TS BLOCKED: himalaya $*" >> "$AUDIT_LOG"
-      echo "ERROR: Command 'himalaya $CMD_STR ...' is blocked by read-only policy." >&2
-      echo "       Audit log: $AUDIT_LOG" >&2
-      exit 100
-    fi
-  done
-done
-
-# ── Allow pass-through ─────────────────────────────────────
-exec "$HIMALAYA_BIN" "$@"