fix: add iptables-nft to wg-easy for nftables-only kernels

wg-easy's Alpine wg-quick uses legacy iptables which requires the
iptable_nat kernel module. On NixOS kernels compiled without legacy
netfilter modules, the container crashes in a restart loop:

  iptables v1.8.3 (legacy): can't initialize iptables table 'nat'
  Table does not exist (do you need to insmod?)

Fix: build a custom image that installs Alpine's iptables-nft package
and symlinks iptables -> iptables-nft (nftables backend).

Makefile

@@ -2,7 +2,7 @@
 COMPOSE_PATH=~/Projects/AltNet/docker-compose
 
 # List of services (folder names)
-SERVICES=monitoring hermes ollama cloudstorage crm_tp crm_cf mediacenter homeautomation network backup homepage passwordmanager
+SERVICES=monitoring ai cloudstorage crm_tp crm_cf mediacenter homeautomation network backup homepage passwordmanager
 
 # Bring up all services
 all_up:

ai/Dockerfile

@@ -0,0 +1,116 @@
+# 1. On récupère la version la plus récente d'UV
+FROM ghcr.io/astral-sh/uv:latest AS uv_source
+
+# 2. Image de base stable
+FROM debian:stable-slim
+
+# Disable Python stdout buffering to ensure logs are printed immediately
+ENV PYTHONUNBUFFERED=1
+
+# Install system dependencies in one layer, clear APT cache
+# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        curl poppler-utils imagemagick \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
+        qemu-user-static binfmt-support qemu-user-binfmt \
+        emacs-nox \
+        libportaudio2 \
+        ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Création de l'utilisateur 'hermes' directement avec les bons accès
+RUN useradd -u 10000 -m -d /opt/data hermes
+
+# Copie d'uv (dernière version)
+COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
+
+WORKDIR /opt/hermes
+
+# On donne la propriété du dossier de travail à l'utilisateur hermes
+RUN chown hermes:hermes /opt/hermes
+
+# ---------- Hermes venv ----------
+# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
+USER hermes
+
+# ---------- Source code ----------
+# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
+COPY --chown=hermes:hermes . .
+
+# ---------- Python virtualenv avec Piper TTS ----------
+RUN uv venv && \
+    uv pip install --no-cache-dir piper-tts sounddevice numpy faster-whisper
+
+# ---------- Télécharger la voix Piper Ryan (high quality) ----------
+RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
+    /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import urllib.request
+base = '/opt/hermes/.venv/share/piper/voices'
+url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
+urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
+urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
+PYEOF
+ 
+# ---------- Patch atomic writes to preserve file permissions ----------
+# Fixes https://github.com/NousResearch/hermes-agent/issues/14181
+# tempfile.mkstemp() creates files as 0600; os.replace() preserves that mode,
+# so group-readable files silently collapse to owner-private 0600.
+# This affects: skills, sessions, memories, and any file written atomically.
+RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import os
+
+patches = [
+    ("/opt/hermes/tools/skill_manager_tool.py", [
+        ("# Restore existing file mode if present", True),  # already patched
+    ]),
+    ("/opt/hermes/tools/skills_sync.py", [
+        ("# Restore existing file mode if present", True),  # already patched
+    ]),
+]
+
+for fpath, checks in patches:
+    if not os.path.exists(fpath):
+        print(f"SKIP {fpath} (not found)")
+        continue
+    with open(fpath) as f:
+        code = f.read()
+    all_ok = all(marker in code for marker, _ in checks)
+    if all_ok:
+        print(f"OK {fpath} (already patched)")
+        continue
+    print(f"PATCH {fpath}")
+    # _atomic_write_text in skill_manager_tool.py
+    code = code.replace(
+        "        os.replace(temp_path, file_path)",
+        "        if file_path.exists():\n"
+        "            existing_mode = file_path.stat().st_mode\n"
+        "            os.chmod(temp_path, existing_mode)\n"
+        "        os.replace(temp_path, file_path)",
+    )
+    # _write_manifest in skills_sync.py
+    code = code.replace(
+        "            os.replace(tmp_path, MANIFEST_FILE)",
+        "            if MANIFEST_FILE.exists():\n"
+        "                existing_mode = MANIFEST_FILE.stat().st_mode\n"
+        "                os.chmod(tmp_path, existing_mode)\n"
+        "            os.replace(tmp_path, MANIFEST_FILE)",
+    )
+    with open(fpath, 'w') as f:
+        f.write(code)
+    print(f"DONE {fpath}")
+PYEOF
+
+# ---------- Runtime ----------
+ENV HERMES_HOME=/opt/data
+ENV PATH="/opt/data/.local/bin:${PATH}"
+
+VOLUME [ "/opt/data" ]
+
+# Copie du script de réparation des permissions (lancement au démarrage)
+COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
+
+# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
+# fix-permissions.sh chown les répertoires critiques avant de chaîner vers entrypoint.sh
+ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]

ai/compose.yml

@@ -0,0 +1,299 @@
+version: "3.8"
+services:
+
+  # webui:
+  #   image: ghcr.io/open-webui/open-webui:main
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
+  hermes:
+    build: ./
+    container_name: hermes
+    restart: always
+    # Gateway run enables the internal API server on port 8642
+    command: gateway run
+    environment:
+      - OLLAMA_HOST=http://ollama:11434
+      - API_SERVER_ENABLED=true
+      - API_SERVER_PORT=8642
+      - API_SERVER_HOST=0.0.0.0
+      - API_SERVER_KEY=hermes_local_key
+      - GATEWAY_ALLOW_ALL_USERS=true
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      # ROCm for GPU-accelerated faster-whisper STT
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0
+    volumes:
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+    networks:
+      - ai_backend
+
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    privileged: true
+    tty: true
+    restart: always 
+    ports:
+      - "127.0.0.1:11434:11434"
+    networks:
+      - ai_backend
+    volumes:
+      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    environment:
+      - OLLAMA_VULKAN=0
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0 
+      - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_DEBUG=1
+      - OLLAMA_FLASH_ATTENTION=0
+      - OLLAMA_NUM_PARALLEL=2
+    devices:
+      # Map the render nodes and KFD for ROCm to work inside the container
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+
+networks:
+  ai_net:
+    external: true
+    name: ai_net
+  ai_backend:
+    driver: bridge
+    name: ai_backend
+    
+  # llama_cpp_devstral:
+  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
+  #   container_name: llama_cpp_devstral
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8080"
+  #   ipc: host
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303" # video
+  #     - "26"  # render
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     LLAMA_CACHE: /models
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
+  #   command: >
+  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
+  #     -a devstral-2-small-llama_cpp
+  #     --chat-template-file /template.jinja
+  #     --host 0.0.0.0
+  #     --port 8080
+  #     --n-gpu-layers 99
+  #     --ctx-size 163840
+  #     --batch-size 4096
+  #     --ubatch-size 4096
+  #     --cache-type-k f16
+  #     --cache-type-v f16
+  #     --cache-reuse 256
+  #     --flash-attn on
+  #     --context-shift
+  #     --split-mode layer
+  #     --no-mmap
+  #     --n-predict -1
+  #     --parallel 2
+
+  # vllm:
+  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
+  #   container_name: vllm
+  #   # Required for multi-GPU communication (NCCL)
+  #   ipc: host 
+  #   init: true
+  #   shm_size: '2g' 
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8000"
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303"
+  #     - "26"
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HSA_ENABLE_SDMA: 0
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     NCCL_P2P_DISABLE: 1
+  #     VLLM_WORKER_MULTIPROC_METHOD: spawn
+  #     VLLM_USE_TRITON_FLASH_ATTN: 0
+  #     VLLM_USE_ROCM_CUSTOM_PAGED_ATTN: 0
+  #     VLLM_ATTENTION_BACKEND: ROPE_NAIVE
+  #     VLLM_SKIP_WARMUP: 1
+  #     VLLM_USE_V1: 0
+  #     HF_TOKEN: ${HF_TOKEN}
+  #   command: >
+  #     vllm serve "mistralai/Devstral-Small-2-24B-Instruct-2512" 
+  #     --tensor-parallel-size 2
+  #     --max-model-len 8192
+  #     --gpu-memory-utilization 0.90
+  #     --tokenizer_mode mistral
+  #     --config_format auto
+  #     --load-format auto
+  #     --enforce-eager
+  #     --disable-custom-all-reduce
+  #     --trust-remote-code
+  #     --task generate
+  #     --block-size 16
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
+  #   restart: unless-stopped
+
+  # n8n:
+  #   image: n8nio/n8n:latest
+  #   container_name: n8n
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_net
+  #   environment:
+  #     - N8N_HOST=n8n.lazyworkhorse.net
+  #     - N8N_PORT=5678
+  #     - N8N_PROTOCOL=https
+  #     - NODE_ENV=production
+  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
+  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
+  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
+  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
+  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
+  #     - N8N_NATIVE_PYTHON_RUNNER=true
+  #     - N8N_PYTHON_ALLOW_STDLIB=uuid,re,os,json
+  #     - N8N_PYTHON_ALLOW_EXTERNAL=requests,pandas
+  #     - NODE_FUNCTION_ALLOW_EXTERNAL=uuid,requests
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/n8n:/home/node/.n8n
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-http.entrypoints=web"
+  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
+  #     - "traefik.http.routers.n8n-https.tls=true"
+  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
+
+  #     # Service Loadbalancer (n8n default port)
+  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+  # openclaw:
+  #   image: coollabsio/openclaw:latest
+  #   container_name: openclaw
+  #   restart: unless-stopped
+  #   expose:
+  #     - "8080"  # WebUI
+  #     - "18789" # Gateway/WebSocket
+  #     - "8788"  # Nextcloud Webhook
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
+  #     - /home/gortium/infra:/data/workspace/infra
+  #   environment:
+  #     - TZ=America/Toronto
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     # Point to the sidecar browser
+  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
+  #     - BROWSER_EVALUATE_ENABLED=true
+  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
+
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.priority=50"
+  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #     - "traefik.http.routers.openclaw-https.tls=true"
+  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   depends_on:
+  #     - openclaw-browser
+
+  # openclaw-browser:
+  #   image: ghcr.io/browserless/chromium:latest
+  #   restart: always
+  #   expose:
+  #     - "3000"
+  #   environment:
+  #     - MAX_CONCURRENT_SESSIONS=10
+  #     - CONNECTION_TIMEOUT=300000
+  #     - PREBOOT_CHROME=true
+  #     - DEMO_MODE=false
+  #   networks:
+  #     ai_backend:
+  #       aliases:
+  #         - browser
+
+  # openclaw-ssh:
+  #   image: linuxserver/openssh-server:latest
+  #   container_name: openclaw-ssh
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
+  #     - SUDO_ACCESS=false
+  #     - PASSWORD_ACCESS=false
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
+  #     - /home/gortium/infra:/data/workspace/infra:ro
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
+  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
+  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
+  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"

ai/fix-permissions.sh

@@ -1,11 +1,13 @@
 #!/bin/bash
-# Startup permission fix + TTS patch.
+# Startup permission fix for the Hermes data volume.
 # Runs as root before the entrypoint drops to the hermes user.
+# Fixes files that were created by root (host agent, cron jobs, etc.)
+# becoming inaccessible to the hermes runtime user.
 set -e
 
 HERMES_HOME="${HERMES_HOME:-/opt/data}"
 
-# Fix ownership on critical writable directories
+# Fix ownership on critical writable directories so hermes user can access them
 chown -R hermes:hermes \
   "$HERMES_HOME/sessions" \
   "$HERMES_HOME/checkpoints" \
@@ -20,19 +22,10 @@ chown -R hermes:hermes \
   "$HERMES_HOME/cache" \
   2>/dev/null || true
 
-# Fix data volume root ownership
+# Also fix the data volume root if it's wrong
 if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
   chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
 fi
 
-# ---------- Patch tts_tool.py: replace Edge TTS with Piper ----------
+# Now chain to the real entrypoint
-# Fallback runtime patch in case the volume's site-packages differ from the image.
-# Idempotent: if already patched, the script does nothing.
-PATCH_SCRIPT="/opt/hermes/patch_tts_tool.py"
-if [ -f "$PATCH_SCRIPT" ]; then
-  echo "Applying TTS patch (Piper only, no Edge fallback)..."
-  /opt/hermes/.venv/bin/python3 "$PATCH_SCRIPT" 2>&1 || true
-fi
-
-# Chain to the official Hermes entrypoint
 exec /opt/hermes/docker/entrypoint.sh "$@"

ai/patch_tts_tool.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Patch Hermes TTS tool: remove Edge TTS, replace with Piper as default/fallback."""
+import sys
+
+tts_path = '/opt/hermes/tools/tts_tool.py'
+
+with open(tts_path) as f:
+    code = f.read()
+
+# Replace the Edge fallback with Piper fallback
+old_edge = '''        else:
+            # Default: Edge TTS (free), with NeuTTS as local fallback
+            edge_available = True
+            try:
+                _import_edge_tts()
+            except ImportError:
+                edge_available = False
+
+            if edge_available:
+                logger.info("Generating speech with Edge TTS...")
+                try:
+                    import concurrent.futures
+                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                        pool.submit(
+                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+                        ).result(timeout=60)
+                except RuntimeError:
+                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+            elif _check_neutts_available():
+                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
+                provider = "neutts"
+                _generate_neutts(text, file_str, tts_config)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
+                             "or set up NeuTTS for local synthesis."
+                }, ensure_ascii=False)'''
+
+new_piper = '''        else:
+            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_available = False
+            try:
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                if os.path.exists(model_path):
+                    piper_available = True
+            except Exception:
+                pass
+
+            if piper_available:
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                if proc.returncode != 0:
+                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                logger.info("Piper TTS audio saved: %s", file_str)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install Piper TTS (pip install piper-tts) "
+                             "and download a voice model."
+                }, ensure_ascii=False)'''
+
+if old_edge in code:
+    code = code.replace(old_edge, new_piper)
+    print("Edge fallback replaced with Piper")
+else:
+    if 'Default: Piper TTS' in code:
+        print("Piper fallback already present")
+    else:
+        print("ERROR: Could not find Edge fallback in tts_tool.py")
+        # Debug output
+        import re
+        for m in re.finditer(r'        else:\n            # Default:', code):
+            start = max(0, m.start() - 100)
+            end = min(len(code), m.end() + 200)
+            print(f"Found else/default at position {m.start()}:")
+            print(code[start:end])
+        sys.exit(1)
+
+with open(tts_path, 'w') as f:
+    f.write(code)
+print("tts_tool.py patched successfully")

hermes/Dockerfile

@@ -1,73 +0,0 @@
-# 1. On récupère la version la plus récente d'UV
-FROM ghcr.io/astral-sh/uv:latest AS uv_source
-
-# 2. Image officielle Hermes Agent de NousResearch
-# Contient déjà: Python, Node.js, npm, Playwright/Chromium, venv, tts_tool.py, etc.
-FROM nousresearch/hermes-agent:latest
-
-# ---------- System dependencies ----------
-# The official hermes-agent image already has: git, curl, ffmpeg, python3,
-# gcc, build-essential, openssh-client, procps, tini, ripgrep, docker-cli,
-# libportaudio2, ca-certificates, etc.
-#
-# These extras we need to add back:
-#   - poppler-utils, imagemagick  (PDF/image processing)
-#   - texlive-*                   (LaTeX typesetting for reports)
-#   - qemu-user-static, binfmt-support (QEMU cross-compilation)
-#   - emacs-nox                   (text editing in container)
-USER root
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        libportaudio2 \
-        ca-certificates \
-        poppler-utils \
-        imagemagick \
-        texlive-latex-base \
-        texlive-latex-extra \
-        texlive-fonts-recommended \
-        texlive-xetex \
-        texlive-science \
-        qemu-user-static \
-        binfmt-support \
-        emacs-nox && \
-    rm -rf /var/lib/apt/lists/*
-
-# ---------- UV (hyperfast pip alternative) ----------
-COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
-
-WORKDIR /opt/hermes
-
-# ---------- Piper TTS dans le venv existant ----------
-# Le venv de l'image de base est root-owned, on doit installer en root aussi
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir piper-tts sounddevice numpy
-
-# ---------- Télécharger la voix Piper Ryan (high quality) ----------
-RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
-    /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import urllib.request
-base = '/opt/hermes/.venv/share/piper/voices'
-url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
-urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
-urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
-PYEOF
-
-# ---------- Patch tts_tool.py: remplacer Edge TTS par Piper ----------
-# Edge TTS appelle les serveurs Microsoft — on ne veut jamais ça.
-# Piper roule localement sur CPU, aucun cloud, aucune donnée qui sort.
-COPY patch_tts_tool.py /tmp/patch_tts_tool.py
-RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
-
-# ---------- Runtime ----------
-# Retour à l'utilisateur non-root pour la sécurité
-USER hermes
-
-ENV HERMES_HOME=/opt/data
-ENV PATH="/opt/data/.local/bin:${PATH}"
-
-VOLUME [ "/opt/data" ]
-
-# Script de réparation des permissions + patch TTS au démarrage
-COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
-
-ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]

hermes/compose.yml

@@ -1,38 +0,0 @@
-version: "3.8"
-services:
-
-  hermes:
-    build: ./
-    container_name: hermes
-    restart: always
-    # Gateway run enables the internal API server on port 8642
-    command: gateway run
-    environment:
-      - OLLAMA_HOST=http://ollama:11434
-      - API_SERVER_ENABLED=true
-      - API_SERVER_PORT=8642
-      - API_SERVER_HOST=0.0.0.0
-      - API_SERVER_KEY=hermes_local_key
-      - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPEN...KEY}
-      # ROCm for GPU-accelerated faster-whisper STT
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0
-    volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-    devices:
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-    networks:
-      - ai_backend
-
-networks:
-  ai_backend:
-    external: true
-    name: ai_backend

hermes/patch_tts_tool.py

@@ -1,181 +0,0 @@
-#!/usr/bin/env python3
-"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
-
-Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
-
-Searches multiple paths for tts_tool.py so it works both at build time
-(in the image venv) and at runtime (on the mounted data volume).
-
-Idempotent: if already patched, does nothing.
-"""
-
-import sys
-import os
-
-# ---------------------------------------------------------------------------
-# Search for all copies of tts_tool.py
-# ---------------------------------------------------------------------------
-CANDIDATE_PATHS = [
-    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
-    "/opt/hermes/tools/tts_tool.py",
-]
-
-found_paths = []
-
-for p in CANDIDATE_PATHS:
-    if os.path.exists(p):
-        found_paths.append(p)
-        print(f"Found tts_tool.py at: {p}")
-
-# Also try to find via Python import
-import subprocess
-try:
-    result = subprocess.run(
-        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
-        capture_output=True, text=True, timeout=5
-    )
-    if result.returncode == 0:
-        p = result.stdout.strip()
-        if os.path.exists(p) and p not in found_paths:
-            found_paths.append(p)
-            print(f"Found tts_tool.py via import at: {p}")
-except Exception:
-    pass
-
-if not found_paths:
-    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
-    print(f"Searched: {CANDIDATE_PATHS}")
-    sys.exit(0)
-
-# ---------------------------------------------------------------------------
-# Old else block: the Edge TTS default fallback to replace
-# ---------------------------------------------------------------------------
-old_else = '''        else:
-            # Default: Edge TTS (free), with NeuTTS as local fallback
-            edge_available = True
-            try:
-                _import_edge_tts()
-            except ImportError:
-                edge_available = False
-
-            if edge_available:
-                logger.info("Generating speech with Edge TTS...")
-                try:
-                    import concurrent.futures
-                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-                        pool.submit(
-                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-                        ).result(timeout=60)
-                except RuntimeError:
-                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-            elif _check_neutts_available():
-                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
-                provider = "neutts"
-                _generate_neutts(text, file_str, tts_config)
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
-                             "or set up NeuTTS for local synthesis."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# New block: elif provider == "piper" + else: fallback with Piper only
-# ---------------------------------------------------------------------------
-new_block = '''        elif provider == "piper":
-            # Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if not os.path.exists(model_path):
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS voice model not found. "
-                             "Install Piper TTS and download a voice model."
-                }, ensure_ascii=False)
-            logger.info("Generating speech with Piper TTS (local, CPU)...")
-            import subprocess as _sp
-            cmd = [piper_binary, "--model", model_path, "--output-raw"]
-            try:
-                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                if proc.returncode != 0:
-                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
-                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-            except Exception as e:
-                return json.dumps({
-                    "success": False,
-                    "error": f"Piper TTS failed: {e}"
-                }, ensure_ascii=False)
-
-        else:
-            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if os.path.exists(model_path) and os.path.exists(piper_binary):
-                logger.info("Generating speech with Piper TTS (local, CPU)...")
-                import subprocess as _sp
-                cmd = [piper_binary, "--model", model_path, "--output-raw"]
-                try:
-                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                    if proc.returncode != 0:
-                        raise RuntimeError(stderr.decode()[:200])
-                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-                except Exception:
-                    pass
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# Apply the patch to all copies found
-# ---------------------------------------------------------------------------
-patched_any = False
-
-for tts_path in found_paths:
-    with open(tts_path) as f:
-        code = f.read()
-
-    if 'provider == "piper"' in code:
-        print(f"ALREADY PATCHED: {tts_path}")
-        continue
-
-    if old_else in code:
-        code = code.replace(old_else, new_block, 1)
-        with open(tts_path, 'w') as f:
-            f.write(code)
-        print(f"PATCHED: {tts_path}")
-        patched_any = True
-    else:
-        print(f"SKIP {tts_path}: Edge fallback pattern not found")
-        import re
-        for m in re.finditer(r'        else:\n            # Default:', code):
-            start = max(0, m.start() - 100)
-            end = min(len(code), m.end() + 300)
-            print(f"  Found 'else:/# Default:' at position {m.start()}:")
-            print(f"  {code[start:end]}")
-            print("  ---")
-        # Don't exit with error — if one copy isn't patchable, try the others
-
-if not patched_any:
-    all_patched = all(
-        'provider == "piper"' in open(p).read()
-        for p in found_paths
-    )
-    if all_patched:
-        print("All copies already patched.")
-        sys.exit(0)
-    print("WARNING: Could not patch any copy of tts_tool.py")
-    sys.exit(1)
-
-print("tts_tool.py patched successfully across all copies.")

ollama/Dockerfile

@@ -1,61 +0,0 @@
-# ollama/Dockerfile
-#
-# Custom ollama image with ROCm + gfx906 (MI50) support.
-# The default ollama/rocm image ships ROCm 7.2 which drops gfx906 support.
-# This builds ollama and its llama.cpp runner from source, targeting gfx906.
-#
-# Build:
-#   docker build -t ollama/ollama:rocm-gfx906 ./ollama
-
-FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    git golang-go cmake build-essential pkg-config \
-    && rm -rf /var/lib/apt/lists/*
-
-ARG OLLAMA_VERSION=v0.23.2
-RUN git clone --depth 1 --branch ${OLLAMA_VERSION} https://github.com/ollama/ollama.git /build
-WORKDIR /build
-
-ENV HIP_PATH=/opt/rocm
-ENV ROCM_PATH=/opt/rocm
-ENV PATH=/opt/rocm/bin:/opt/rocm/hip/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-RUN cd llama.cpp && \
-    mkdir -p build && cd build && \
-    cmake .. \
-      -DLLAMA_HIPBLAS=ON \
-      -DCMAKE_C_COMPILER=clang \
-      -DCMAKE_CXX_COMPILER=clang++ \
-      -DAMDGPU_TARGETS=gfx906 \
-      -DCMAKE_BUILD_TYPE=Release \
-      -DLLAMA_NATIVE=OFF \
-      -DLLAMA_BUILD_TESTS=OFF \
-      -DLLAMA_BUILD_EXAMPLES=OFF \
-      -DLLAMA_BUILD_SERVER=OFF && \
-    cmake --build . --config Release -j$(nproc) && \
-    cmake --install . --prefix /build/dist
-
-ENV CGO_ENABLED=0
-RUN go build -trimpath -o dist/ollama .
-
-FROM ubuntu:22.04
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    ca-certificates curl libstdc++6 libgomp1 \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
-COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
-COPY --from=builder /build/dist/ollama /usr/bin/ollama
-COPY --from=builder /build/dist/lib/ /usr/lib/ollama/
-
-RUN ldconfig
-
-ENV LD_LIBRARY_PATH=/opt/rocm/lib:/usr/lib/ollama
-ENV HSA_OVERRIDE_GFX_VERSION=9.0.6
-ENV HCC_AMDGPU_TARGET=gfx906
-ENV HSA_ENABLE_SDMA=0
-
-EXPOSE 11434
-ENTRYPOINT ["/bin/ollama"]
-CMD ["serve"]

ollama/compose.yml

@@ -1,41 +0,0 @@
-version: "3.8"
-
-services:
-  ollama:
-    build:
-      context: ./
-      dockerfile: Dockerfile
-    image: ollama/ollama:rocm-gfx906
-    container_name: ollama
-    privileged: true
-    tty: true
-    restart: always
-    ports:
-      - "127.0.0.1:11434:11434"
-    networks:
-      - ai_backend
-    volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
-    environment:
-      - OLLAMA_VULKAN=0
-      - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=0
-      - OLLAMA_NUM_PARALLEL=2
-      # ROCm / gfx906 configuration
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0
-    devices:
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-
-networks:
-  ai_backend:
-    external: true
-    name: ai_backend

vpn/Dockerfile

@@ -0,0 +1,16 @@
+# Custom wg-easy with iptables-nft (nftables-backed iptables)
+# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
+FROM weejewel/wg-easy:latest
+
+# Alpine's iptables-nft provides iptables that uses nftables kernel API
+# instead of the legacy iptable_nat module. This works on kernels
+# where only nftables netfilter modules are available.
+RUN apk add --no-cache iptables-nft
+
+# Ensure iptables-nft takes priority over legacy iptables
+RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
+    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
+    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
+    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
+    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
+    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore

vpn/compose.yml

@@ -2,7 +2,10 @@ version: "3.8"
 
 services:
   wireguard:
-    image: weejewel/wg-easy:latest
+    build:
+      context: ./vpn
+      dockerfile: Dockerfile
+    image: wg-easy-iptables-nft:latest
     container_name: wireguard
     cap_add:
       - NET_ADMIN