feat(ai): add chromium browser automation support (PR 2/5)

Add browser automation packages for Playwright/headless Chrome:
- chromium: Headless browser
- xvfb: Virtual framebuffer for headless operation
- fonts-*: Font support for proper rendering
- lib*-runtime: Chromium runtime dependencies

Depends on PR #7 (curl, poppler-utils, imagemagick)

ai/Dockerfile

@@ -1,160 +1,66 @@
-# 1. On récupère la version la plus récente d'UV
-FROM ghcr.io/astral-sh/uv:latest AS uv_source
-
-# 2. Image de base stable
-FROM debian:stable-slim
+FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
+FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
+FROM debian:13.4
 
 # Disable Python stdout buffering to ensure logs are printed immediately
 ENV PYTHONUNBUFFERED=1
 
+# Store Playwright browsers outside the volume mount so the build-time
+# install survives the /opt/data volume overlay at runtime.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
+
 # Install system dependencies in one layer, clear APT cache
 # tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+# that would otherwise accumulate when hermes runs as PID 1. See #15012.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
         curl poppler-utils imagemagick \
-        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
-        qemu-user-static binfmt-support qemu-user-binfmt \
-        emacs-nox \
-        libportaudio2 \
-        hipcc espeak-ng && \
+        chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
+        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 && \
     rm -rf /var/lib/apt/lists/*
 
-# Création de l'utilisateur 'hermes' directement avec les bons accès
+# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
 RUN useradd -u 10000 -m -d /opt/data hermes
 
-# Copie d'uv (dernière version)
-COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
+COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
+COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
 
 WORKDIR /opt/hermes
 
-# On donne la propriété du dossier de travail à l'utilisateur hermes
-RUN chown hermes:hermes /opt/hermes
+# ---------- Layer-cached dependency install ----------
+# Copy only package manifests first so npm install + Playwright are cached
+# unless the lockfiles themselves change.
+COPY package.json package-lock.json ./
+COPY web/package.json web/package-lock.json web/
 
-# ---------- Coqui TTS venv (Python 3.11 + PyTorch ROCm) ----------
-# Install Python 3.11 via uv for Coqui compatibility
-RUN uv python install 3.11
-
-# Create the coqui venv and install PyTorch ROCm + TTS
-RUN uv venv --python 3.11 /opt/coqui-tts
-RUN uv pip install --python /opt/coqui-tts/bin/python3 --no-cache-dir \
-    torch==2.3.1+rocm5.7 \
-    torchaudio==2.3.1+rocm5.7 \
-    --index-url https://download.pytorch.org/whl/rocm5.7
-RUN uv pip install --python /opt/coqui-tts/bin/python3 --no-cache-dir TTS setuptools
-
-# Fix executable stack on bundled torch AMD libraries (required for ROCm)
-RUN /opt/coqui-tts/bin/python3 -c "
-import struct, os, glob
-torch_lib = '/opt/coqui-tts/lib/python3.11/site-packages/torch/lib'
-for so in glob.glob(os.path.join(torch_lib, '*.so*')):
-    try:
-        with open(so, 'r+b') as f:
-            if f.read(4) != b'\x7fELF': continue
-            f.seek(0)
-            h = f.read(64)
-            e_phoff = struct.unpack_from('<Q', h, 0x20)[0]
-            e_phentsize = struct.unpack_from('<H', h, 0x36)[0]
-            e_phnum = struct.unpack_from('<H', h, 0x38)[0]
-            for i in range(e_phnum):
-                f.seek(e_phoff + i * e_phentsize)
-                ph = f.read(e_phentsize)
-                if struct.unpack_from('<I', ph, 0)[0] == 0x6474e551:
-                    flags = struct.unpack_from('<I', ph, 4)[0]
-                    if flags & 1:
-                        f.seek(e_phoff + i * e_phentsize + 4)
-                        f.write(struct.pack('<I', flags - 1))
-                    break
-    except: pass
-"
-
-# Créer le wrapper Coqui synth
-RUN /opt/coqui-tts/bin/python3 -c "
-script = '''#!/usr/bin/env python3
-import argparse, sys
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument('--text', required=True)
-    parser.add_argument('--out', required=True)
-    parser.add_argument('--model', default='tts_models/en/vctk/vits')
-    parser.add_argument('--speaker', default='')
-    parser.add_argument('--gpu', action='store_true', default=True)
-    args = parser.parse_args()
-    try:
-        from TTS.api import TTS
-        tts = TTS(model_name=args.model, progress_bar=False, gpu=args.gpu)
-        kwargs = {'text': args.text, 'file_path': args.out}
-        if args.speaker and hasattr(tts, 'speakers') and tts.speakers:
-            kwargs['speaker'] = args.speaker
-        tts.tts_to_file(**kwargs)
-        print('OK:' + args.out)
-    except Exception as e:
-        print('ERROR:' + str(e), file=sys.stderr)
-        sys.exit(1)
-if __name__ == '__main__':
-    main()
-'''
-with open('/opt/coqui-tts/bin/coqui_synth.py', 'w') as f:
-    f.write(script)
-import os; os.chmod('/opt/coqui-tts/bin/coqui_synth.py', 0o755)
-"
-
-# ---------- Hermes venv ----------
-# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
-USER hermes
+RUN npm install --prefer-offline --no-audit && \
+    npx playwright install --with-deps chromium --only-shell && \
+    (cd web && npm install --prefer-offline --no-audit) && \
+    npm cache clean --force
 
 # ---------- Source code ----------
-# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
+# .dockerignore excludes node_modules, so the installs above survive.
 COPY --chown=hermes:hermes . .
 
+# Build web dashboard (Vite outputs to hermes_cli/web_dist/)
+RUN cd web && npm run build
+
+# ---------- Permissions ----------
+# Make install dir world-readable so any HERMES_UID can read it at runtime.
+# The venv needs to be traversable too.
+USER root
+RUN chmod -R a+rX /opt/hermes
+# Start as root so the entrypoint can usermod/groupmod + gosu.
+# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).
+
 # ---------- Python virtualenv ----------
 RUN uv venv && \
-    uv pip install --no-cache-dir sounddevice numpy faster-whisper
-
-# ---------- Patch tts_tool.py to add Coqui provider ----------
-RUN /opt/hermes/.venv/bin/python3 -c "
-tts_path = '/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py'
-with open(tts_path) as f:
-    code = f.read()
-coqui_block = '''
-        elif provider == \"coqui\":
-            logger.info(\"Generating speech with Coqui TTS (GPU, local)...\")
-            import subprocess
-            coqui_python = \"/opt/coqui-tts/bin/python3\"
-            coqui_script = \"/opt/coqui-tts/bin/coqui_synth.py\"
-            coqui_config = tts_config.get(\"coqui\", {})
-            model = coqui_config.get(\"model\", \"tts_models/en/vctk/vits\")
-            use_gpu = coqui_config.get(\"use_gpu\", True)
-            speaker = coqui_config.get(\"speaker\", \"\")
-            cmd = [
-                coqui_python, coqui_script,
-                \"--text\", text,
-                \"--out\", file_str,
-                \"--model\", model,
-            ]
-            if use_gpu:
-                cmd.append(\"--gpu\")
-            if speaker:
-                cmd.extend([\"--speaker\", speaker])
-            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
-            if result.returncode != 0:
-                stderr = result.stderr.strip()
-                raise RuntimeError(f\"Coqui TTS failed: {stderr or 'unknown error'}\")
-            logger.info(\"Coqui TTS audio saved: %s\", file_str)
-'''
-code = code.replace(
-    '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback',
-    coqui_block + '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback'
-)
-with open(tts_path, 'w') as f:
-    f.write(code)
-"
+    uv pip install --no-cache-dir -e ".[all]"
 
 # ---------- Runtime ----------
+ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"
-
 VOLUME [ "/opt/data" ]
-
-# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
 ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]

ai/compose.yml

@@ -1,32 +1,32 @@
 version: "3.8"
 services:
 
-  # webui:
-  #   image: ghcr.io/open-webui/open-webui:main
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
-  #   restart: always
-  #   environment:
-  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
+  webui:
+    image: ghcr.io/open-webui/open-webui:main
+    volumes:
+      - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+    restart: always
+    environment:
+      - OLLAMA_API_BASE_URL=http://ollama:11434/api
+    networks:
+      - ai_net
+      - ai_backend
+    labels:
+      - "traefik.enable=true"
 
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-http.entrypoints=web"
-  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+      # Router for HTTP + redirection to HTTPS
+      - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+      - "traefik.http.routers.webui-http.entrypoints=web"
+      - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
 
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
-  #     - "traefik.http.routers.webui-https.tls=true"
-  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+      # Router for HTTPS with TLS
+      - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+      - "traefik.http.routers.webui-https.entrypoints=websecure"
+      - "traefik.http.routers.webui-https.tls=true"
+      - "traefik.http.routers.webui-https.tls.certresolver=njalla"
 
   hermes:
-    build: ./
+    image: nousresearch/hermes-agent:latest
     container_name: hermes
     restart: always
     # Gateway run enables the internal API server on port 8642
@@ -38,13 +38,7 @@ services:
       - API_SERVER_HOST=0.0.0.0
       - API_SERVER_KEY=hermes_local_key
       - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPEN...KEY}
-      # ROCm for GPU-accelerated faster-whisper STT
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     devices:

coms/compose.yml

@@ -1,15 +1,15 @@
 version: "3.9"
 services:
-  # nomadnet:
-  #   image: ghcr.io/markqvist/nomadnet:master
-  #   container_name: nomadnet
-  #   restart: always
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
-  #     - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
-  #   # Reticulum transport must be reachable directly (NOT through Traefik)
-  #   ports:
-  #     - "4242:4242"
+  nomadnet:
+    image: ghcr.io/markqvist/nomadnet:master
+    container_name: nomadnet
+    restart: always
+    volumes:
+      - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
+      - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
+    # Reticulum transport must be reachable directly (NOT through Traefik)
+    ports:
+      - "4242:4242"
 
   synapse:
     image: ghcr.io/element-hq/synapse:latest

network/compose.yml

@@ -13,20 +13,17 @@ services:
       - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
       - "--certificatesresolvers.njalla.acme.httpchallenge.entrypoint=web"
 
-      - "--log.level=INFO"
-      - "--log.filepath=/var/log/traefik/traefik.log"
-      - "--accesslog.filepath=/var/log/traefik/access.log"
+      - "--log.level=DEBUG"
       - "--providers.docker=true"
       - "--providers.docker.exposedByDefault=false"
     ports:
       - "80:80"
       - "443:443"
     environment:
-      - NJALLA_TOKEN=***
+      - NJALLA_TOKEN=${NJALLA_TOKEN}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
-      - /var/log/traefik:/var/log/traefik
     restart: unless-stopped
     networks:
       - traefik_backend

vpn/compose.yml

@@ -1,35 +0,0 @@
-version: "3.8"
-
-services:
-  wireguard:
-    image: weejewel/wg-easy:latest
-    container_name: wireguard
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    environment:
-      - WG_HOST=vpn.lazyworkhorse.net
-      - PASSWORD=${WG_PASSWORD}
-      - WG_PORT=51820
-      - WG_DEFAULT_ADDRESS=10.8.0.x
-      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
-      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
-      - WG_PERSISTENT_KEEPALIVE=25
-      - UI_TRAFFIC_STATS=true
-      - UI_CHART_TYPE=0
-    ports:
-      - "51820:51820/udp"
-      - "51821:51821/tcp"
-    volumes:
-      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv4.ip_forward=1
-    restart: unless-stopped
-    networks:
-      - vpn_net
-
-networks:
-  vpn_net:
-    external: true
-    name: vpn_net