fix(hermes-workspace): add HOST=0.0.0.0 for Traefik reachability, drop redundant nodejs install

The base hermets-agent image already ships Node.js; apt-get nodejs could conflict or downgrade it. Only install tmux and curl. Add ENV HOST=0.0.0.0 so the workspace listens on all interfaces (default 127.0.0.1 makes it unreachable via Traefik reverse proxy). Add ENV NODE_ENV=production for production-mode optimizations.
Revert "fix(hermes-workspace): add HOST/ENV vars, drop redundant nodejs install"
2026-05-20 14:07:26 -04:00 · 2026-05-20 14:05:51 -04:00 · 2026-05-20 14:05:41 -04:00 · 2026-05-20 14:04:05 -04:00 · 2026-05-19 21:29:47 -04:00 · 2026-05-19 21:23:09 -04:00
2 changed files with 30 additions and 2 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -70,6 +70,30 @@ services:
      - "26"
    networks:
      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
+      # Router for HTTP + redirect to HTTPS
+      - "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
+      - "traefik.http.routers.hermes-web-http.entrypoints=web"
+      - "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
+
+      # Router for HTTPS with TLS — protected by Authelia
+      - "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
+      - "traefik.http.routers.hermes-web-https.entrypoints=websecure"
+      - "traefik.http.routers.hermes-web-https.tls=true"
+      - "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
+      - "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
+
+      # Authelia forwardAuth
+      - "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
+      - "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
+      - "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
+
+      # Service Loadbalancer (dashboard port 9119)
+      - "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8642/health && curl -fsS http://localhost:9119/api/status || exit 1"]
      interval: 15s
--- a/ai/hermes-workspace/Dockerfile
+++ b/ai/hermes-workspace/Dockerfile
@@ -29,10 +29,12 @@ RUN pnpm install --frozen-lockfile && pnpm build
 # ---------- Stage 2: Hermes Agent + Workspace runtime ----------
 FROM nousresearch/hermes-agent:latest

-# ---------- Install Node.js + tmux for Workspace + Swarm ----------
+# ---------- Install tmux for Swarm workers + curl for health checks ----------
+# Note: Node.js is already shipped with the base hermets-agent image; apt's nodejs
+# would be older and could conflict. Only add what's missing.
 USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs tmux ca-certificates curl \
+    tmux curl \
    && rm -rf /var/lib/apt/lists/*

 # ---------- Overlay our forked Hermes source ----------
@@ -115,6 +117,8 @@ USER hermes
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"
 ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
+ENV HOST=0.0.0.0
+ENV NODE_ENV=production

 RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
Author	SHA1	Message	Date
Hermes	62fa78b97f	fix(hermes-workspace): add HOST=0.0.0.0 for Traefik reachability, drop redundant nodejs install The base hermets-agent image already ships Node.js; apt-get nodejs could conflict or downgrade it. Only install tmux and curl. Add ENV HOST=0.0.0.0 so the workspace listens on all interfaces (default 127.0.0.1 makes it unreachable via Traefik reverse proxy). Add ENV NODE_ENV=production for production-mode optimizations.	2026-05-20 14:07:26 -04:00
Hermes	cd9bda57c3	Revert "fix(hermes-workspace): add HOST/ENV vars, drop redundant nodejs install" This reverts commit `735ddcb555`.	2026-05-20 14:05:51 -04:00
Hermes	735ddcb555	fix(hermes-workspace): add HOST/ENV vars, drop redundant nodejs install - Add ENV HOST=0.0.0.0 so workspace listens on all interfaces (required for Traefik reverse proxy to reach it) - Add ENV NODE_ENV=production for production-mode optimizations - Remove apt-get install of nodejs (already in base image, apt version would be older and could conflict) - Only install tmux and curl in the workspace layer - entrypoint-combined.sh: rewritten with proper logging, graceful shutdown, configurable gateway health check	2026-05-20 14:05:41 -04:00
Hermes	817f1cbcc2	feat(hermes): add Traefik routing + Authelia auth for dashboard	2026-05-20 14:04:05 -04:00
Hermes	8e09e5bdfe	Revert "feat(hermes): drop fork overlay, use upstream base image for v0.12.0+ kanban" This reverts commit `d94014f19a`.	2026-05-19 21:29:47 -04:00
Hermes	d94014f19a	feat(hermes): drop fork overlay, use upstream base image for v0.12.0+ kanban	2026-05-19 21:23:09 -04:00