fix: add iptables-nft to wg-easy for nftables-only kernels

wg-easy's Alpine wg-quick uses legacy iptables which requires the iptable_nat kernel module. On NixOS kernels compiled without legacy netfilter modules, the container crashes in a restart loop: iptables v1.8.3 (legacy): can't initialize iptables table 'nat' Table does not exist (do you need to insmod?) Fix: build a custom image that installs Alpine's iptables-nft package and symlinks iptables -> iptables-nft (nftables backend).
fix: add startup permission fix for data volume (chown critical dirs on boot)
2026-05-12 14:52:33 -04:00 · 2026-05-09 16:04:32 +00:00 · 2026-05-09 15:50:29 +00:00 · 2026-05-09 15:21:49 +00:00 · 2026-05-09 14:28:35 +00:00 · 2026-05-09 14:27:07 +00:00
17 changed files with 717 additions and 195 deletions
--- a/ai/Dockerfile
+++ b/ai/Dockerfile
@@ -0,0 +1,116 @@
+# 1. On récupère la version la plus récente d'UV
+FROM ghcr.io/astral-sh/uv:latest AS uv_source
+
+# 2. Image de base stable
+FROM debian:stable-slim
+
+# Disable Python stdout buffering to ensure logs are printed immediately
+ENV PYTHONUNBUFFERED=1
+
+# Install system dependencies in one layer, clear APT cache
+# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        curl poppler-utils imagemagick \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
+        qemu-user-static binfmt-support qemu-user-binfmt \
+        emacs-nox \
+        libportaudio2 \
+        ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Création de l'utilisateur 'hermes' directement avec les bons accès
+RUN useradd -u 10000 -m -d /opt/data hermes
+
+# Copie d'uv (dernière version)
+COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
+
+WORKDIR /opt/hermes
+
+# On donne la propriété du dossier de travail à l'utilisateur hermes
+RUN chown hermes:hermes /opt/hermes
+
+# ---------- Hermes venv ----------
+# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
+USER hermes
+
+# ---------- Source code ----------
+# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
+COPY --chown=hermes:hermes . .
+
+# ---------- Python virtualenv avec Piper TTS ----------
+RUN uv venv && \
+    uv pip install --no-cache-dir piper-tts sounddevice numpy faster-whisper
+
+# ---------- Télécharger la voix Piper Ryan (high quality) ----------
+RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
+    /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import urllib.request
+base = '/opt/hermes/.venv/share/piper/voices'
+url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
+urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
+urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
+PYEOF
+ 
+# ---------- Patch atomic writes to preserve file permissions ----------
+# Fixes https://github.com/NousResearch/hermes-agent/issues/14181
+# tempfile.mkstemp() creates files as 0600; os.replace() preserves that mode,
+# so group-readable files silently collapse to owner-private 0600.
+# This affects: skills, sessions, memories, and any file written atomically.
+RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import os
+
+patches = [
+    ("/opt/hermes/tools/skill_manager_tool.py", [
+        ("# Restore existing file mode if present", True),  # already patched
+    ]),
+    ("/opt/hermes/tools/skills_sync.py", [
+        ("# Restore existing file mode if present", True),  # already patched
+    ]),
+]
+
+for fpath, checks in patches:
+    if not os.path.exists(fpath):
+        print(f"SKIP {fpath} (not found)")
+        continue
+    with open(fpath) as f:
+        code = f.read()
+    all_ok = all(marker in code for marker, _ in checks)
+    if all_ok:
+        print(f"OK {fpath} (already patched)")
+        continue
+    print(f"PATCH {fpath}")
+    # _atomic_write_text in skill_manager_tool.py
+    code = code.replace(
+        "        os.replace(temp_path, file_path)",
+        "        if file_path.exists():\n"
+        "            existing_mode = file_path.stat().st_mode\n"
+        "            os.chmod(temp_path, existing_mode)\n"
+        "        os.replace(temp_path, file_path)",
+    )
+    # _write_manifest in skills_sync.py
+    code = code.replace(
+        "            os.replace(tmp_path, MANIFEST_FILE)",
+        "            if MANIFEST_FILE.exists():\n"
+        "                existing_mode = MANIFEST_FILE.stat().st_mode\n"
+        "                os.chmod(tmp_path, existing_mode)\n"
+        "            os.replace(tmp_path, MANIFEST_FILE)",
+    )
+    with open(fpath, 'w') as f:
+        f.write(code)
+    print(f"DONE {fpath}")
+PYEOF
+
+# ---------- Runtime ----------
+ENV HERMES_HOME=/opt/data
+ENV PATH="/opt/data/.local/bin:${PATH}"
+
+VOLUME [ "/opt/data" ]
+
+# Copie du script de réparation des permissions (lancement au démarrage)
+COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
+
+# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
+# fix-permissions.sh chown les répertoires critiques avant de chaîner vers entrypoint.sh
+ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -1,31 +1,106 @@
+version: "3.8"
 services:

-  webui:
-    image: ghcr.io/open-webui/open-webui:main
-    volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  # webui:
+  #   image: ghcr.io/open-webui/open-webui:main
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
+  hermes:
+    build: ./
+    container_name: hermes
+    restart: always
+    # Gateway run enables the internal API server on port 8642
+    command: gateway run
    environment:
-      - OLLAMA_API_BASE_URL=http://ollama:11434/api
+      - OLLAMA_HOST=http://ollama:11434
+      - API_SERVER_ENABLED=true
+      - API_SERVER_PORT=8642
+      - API_SERVER_HOST=0.0.0.0
+      - API_SERVER_KEY=hermes_local_key
+      - GATEWAY_ALLOW_ALL_USERS=true
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      # ROCm for GPU-accelerated faster-whisper STT
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0
+    volumes:
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
    networks:
-      - traefik-net
-    labels:
-      - "traefik.enable=true"
+      - ai_backend

-      # Router for HTTP + redirection to HTTPS
-      - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
-      - "traefik.http.routers.webui-http.entrypoints=web"
-      - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
-
-      # Router for HTTPS with TLS
-      - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
-      - "traefik.http.routers.webui-https.entrypoints=websecure"
-      - "traefik.http.routers.webui-https.tls=true"
-      - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    privileged: true
+    tty: true
+    restart: always 
+    ports:
+      - "127.0.0.1:11434:11434"
+    networks:
+      - ai_backend
+    volumes:
+      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    environment:
+      - OLLAMA_VULKAN=0
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0 
+      - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_DEBUG=1
+      - OLLAMA_FLASH_ATTENTION=0
+      - OLLAMA_NUM_PARALLEL=2
+    devices:
+      # Map the render nodes and KFD for ROCm to work inside the container
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"

+networks:
+  ai_net:
+    external: true
+    name: ai_net
+  ai_backend:
+    driver: bridge
+    name: ai_backend
+    
  # llama_cpp_devstral:
  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
  #   container_name: llama_cpp_devstral
  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
  #   ports:
  #     - "8300:8080"
  #   ipc: host
@@ -70,7 +145,7 @@ services:
  #   init: true
  #   shm_size: '2g' 
  #   networks:
-  #     - traefik-net
+  #     - ai_backend
  #   ports:
  #     - "8300:8000"
  #   devices:
@@ -108,43 +183,12 @@ services:
  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
  #   restart: unless-stopped

-  ollama:
-    image: ollama/ollama:latest
-    container_name: ollama
-    privileged: true
-    tty: true
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:11434:11434"
-    networks:
-      - traefik-net
-    volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
-    environment:
-      - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
-      - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=0
-      - OLLAMA_NUM_PARALLEL=2
-    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-
  # n8n:
  #   image: n8nio/n8n:latest
  #   container_name: n8n
  #   restart: unless-stopped
  #   networks:
-  #     - traefik-net
+  #     - ai_net
  #   environment:
  #     - N8N_HOST=n8n.lazyworkhorse.net
  #     - N8N_PORT=5678
@@ -177,62 +221,79 @@ services:

  #     # Service Loadbalancer (n8n default port)
  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
-       
-  openclaw:
-    image: coollabsio/openclaw:latest
-    container_name: openclaw
-    restart: unless-stopped
-    expose:
-      - "8080"  # WebUI
-      - "18789" # Gateway/WebSocket
-      - "8788"  # Nextcloud Webhook
-    networks:
-      - traefik-net
-    volumes:
-      - /mnt/HoardingCow_docker_data/openclaw/data:/data
-      - /home/gortium/infra:/data/workspace/infra
-    environment:
-      - TZ=America/Toronto
-      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-      # Point to the sidecar browser
-      - BROWSER_CDP_URL=http://openclaw-browser:9222
-      - BROWSER_EVALUATE_ENABLED=true
-      - OPENCLAW_GATEWAY_HOST=0.0.0.0
-      - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net

-    labels:
-      - "traefik.enable=true"
+  # openclaw:
+  #   image: coollabsio/openclaw:latest
+  #   container_name: openclaw
+  #   restart: unless-stopped
+  #   expose:
+  #     - "8080"  # WebUI
+  #     - "18789" # Gateway/WebSocket
+  #     - "8788"  # Nextcloud Webhook
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
+  #     - /home/gortium/infra:/data/workspace/infra
+  #   environment:
+  #     - TZ=America/Toronto
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     # Point to the sidecar browser
+  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
+  #     - BROWSER_EVALUATE_ENABLED=true
+  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #   labels:
+  #     - "traefik.enable=true"

-      - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
-      - "traefik.http.routers.openclaw-http.entrypoints=web"
-      - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"

-      - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
-      - "traefik.http.routers.openclaw-https.priority=50"
-      - "traefik.http.routers.openclaw-https.entrypoints=websecure"
-      - "traefik.http.routers.openclaw-https.tls=true"
-      - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
-      - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.priority=50"
+  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #     - "traefik.http.routers.openclaw-https.tls=true"
+  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   depends_on:
+  #     - openclaw-browser

-    depends_on:
-      - openclaw-browser
+  # openclaw-browser:
+  #   image: ghcr.io/browserless/chromium:latest
+  #   restart: always
+  #   expose:
+  #     - "3000"
+  #   environment:
+  #     - MAX_CONCURRENT_SESSIONS=10
+  #     - CONNECTION_TIMEOUT=300000
+  #     - PREBOOT_CHROME=true
+  #     - DEMO_MODE=false
+  #   networks:
+  #     ai_backend:
+  #       aliases:
+  #         - browser

-  openclaw-browser:
-    image: ghcr.io/browserless/chromium:latest
-    restart: always
-    expose:
-      - "3000"
-    environment:
-      - MAX_CONCURRENT_SESSIONS=10
-      - CONNECTION_TIMEOUT=300000
-      - PREBOOT_CHROME=true
-      - DEMO_MODE=false
-    networks:
-      traefik-net:
-        aliases:
-          - browser
-
-networks:
-  traefik-net:
-    external: true
+  # openclaw-ssh:
+  #   image: linuxserver/openssh-server:latest
+  #   container_name: openclaw-ssh
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
+  #     - SUDO_ACCESS=false
+  #     - PASSWORD_ACCESS=false
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
+  #     - /home/gortium/infra:/data/workspace/infra:ro
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
+  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
+  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
+  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"
--- a/ai/fix-permissions.sh
+++ b/ai/fix-permissions.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Startup permission fix for the Hermes data volume.
+# Runs as root before the entrypoint drops to the hermes user.
+# Fixes files that were created by root (host agent, cron jobs, etc.)
+# becoming inaccessible to the hermes runtime user.
+set -e
+
+HERMES_HOME="${HERMES_HOME:-/opt/data}"
+
+# Fix ownership on critical writable directories so hermes user can access them
+chown -R hermes:hermes \
+  "$HERMES_HOME/sessions" \
+  "$HERMES_HOME/checkpoints" \
+  "$HERMES_HOME/skills" \
+  "$HERMES_HOME/memories" \
+  "$HERMES_HOME/workspace" \
+  "$HERMES_HOME/pastes" \
+  "$HERMES_HOME/logs" \
+  "$HERMES_HOME/cron" \
+  "$HERMES_HOME/plans" \
+  "$HERMES_HOME/hooks" \
+  "$HERMES_HOME/cache" \
+  2>/dev/null || true
+
+# Also fix the data volume root if it's wrong
+if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
+  chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
+fi
+
+# Now chain to the real entrypoint
+exec /opt/hermes/docker/entrypoint.sh "$@"
--- a/ai/patch_tts_tool.py
+++ b/ai/patch_tts_tool.py
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Patch Hermes TTS tool: remove Edge TTS, replace with Piper as default/fallback."""
+import sys
+
+tts_path = '/opt/hermes/tools/tts_tool.py'
+
+with open(tts_path) as f:
+    code = f.read()
+
+# Replace the Edge fallback with Piper fallback
+old_edge = '''        else:
+            # Default: Edge TTS (free), with NeuTTS as local fallback
+            edge_available = True
+            try:
+                _import_edge_tts()
+            except ImportError:
+                edge_available = False
+
+            if edge_available:
+                logger.info("Generating speech with Edge TTS...")
+                try:
+                    import concurrent.futures
+                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                        pool.submit(
+                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+                        ).result(timeout=60)
+                except RuntimeError:
+                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+            elif _check_neutts_available():
+                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
+                provider = "neutts"
+                _generate_neutts(text, file_str, tts_config)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
+                             "or set up NeuTTS for local synthesis."
+                }, ensure_ascii=False)'''
+
+new_piper = '''        else:
+            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_available = False
+            try:
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                if os.path.exists(model_path):
+                    piper_available = True
+            except Exception:
+                pass
+
+            if piper_available:
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                if proc.returncode != 0:
+                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                logger.info("Piper TTS audio saved: %s", file_str)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install Piper TTS (pip install piper-tts) "
+                             "and download a voice model."
+                }, ensure_ascii=False)'''
+
+if old_edge in code:
+    code = code.replace(old_edge, new_piper)
+    print("Edge fallback replaced with Piper")
+else:
+    if 'Default: Piper TTS' in code:
+        print("Piper fallback already present")
+    else:
+        print("ERROR: Could not find Edge fallback in tts_tool.py")
+        # Debug output
+        import re
+        for m in re.finditer(r'        else:\n            # Default:', code):
+            start = max(0, m.start() - 100)
+            end = min(len(code), m.end() + 200)
+            print(f"Found else/default at position {m.start()}:")
+            print(code[start:end])
+        sys.exit(1)
+
+with open(tts_path, 'w') as f:
+    f.write(code)
+print("tts_tool.py patched successfully")
--- a/authentification/compose.yml
+++ b/authentification/compose.yml
@@ -7,8 +7,8 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Authelia:/config
    networks:
-      - traefik-net
-    restart: unless-stopped
+      - auth_net
+    restart: always 
    labels:
      - "traefik.enable=true"

@@ -31,5 +31,6 @@ services:
      - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"

 networks:
-  traefik-net:
+  auth_net:
    external: true
+    name: auth_net
--- a/backup/compose.yml
+++ b/backup/compose.yml
@@ -1,55 +1,100 @@
 version: "3.8"

 services:
-  kopia:
-    image: kopia/kopia:latest
-    container_name: kopia
-    restart: unless-stopped
-    # We explicitly run as root (0:0) to solve the CHDIR issue, 
-    # OR we make sure the host folders match UID 1000.
-    user: "0:0" 
-    command:
-      - server
-      - start
-      - --address=0.0.0.0:51515
-      - --server-username=${KOPIA_SERVER_USER}
-      - --server-password=${KOPIA_SERVER_PASSWORD}
-      - --config-file=/app/config/repository.config
-      - --disable-csrf-token-checks
-      - --insecure
+  # kopia:
+  #   image: kopia/kopia:latest
+  #   container_name: kopia
+  #   restart: unless-stopped
+  #   # We explicitly run as root (0:0) to solve the CHDIR issue, 
+  #   # OR we make sure the host folders match UID 1000.
+  #   user: "0:0" 
+  #   command:
+  #     - server
+  #     - start
+  #     - --address=0.0.0.0:51515
+  #     - --server-username=${KOPIA_SERVER_USER}
+  #     - --server-password=${KOPIA_SERVER_PASSWORD}
+  #     - --config-file=/app/config/repository.config
+  #     - --disable-csrf-token-checks
+  #     - --insecure
+  #   environment:
+  #     - TZ=America/Montreal
+  #     - KOPIA_PASSWORD=${KOPIA_PASSWORD}
+  #     - USER=${KOPIA_USER}
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
+  #     - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
+  #     - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
+  #     # Required if you want to use the 'Mount' feature later
+  #     - /tmp:/tmp:shared
+  #     # Required for mounting backups as drives
+  #   cap_add:
+  #     - SYS_ADMIN
+  #   devices:
+  #     - /dev/fuse:/dev/fuse
+  #   networks:
+  #     - traefik-net
+  #   labels:
+  #     - "traefik.enable=true"
+  #     # 1. HTTP to HTTPS Redirect
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia-http.entrypoints=web"
+  #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+  #     
+  #     # 2. HTTPS Configuration
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia.entrypoints=websecure"
+  #     - "traefik.http.routers.kopia.tls=true"
+  #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
+  #     
+  #     # 3. Backend Service Config
+  #     - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+
+  restic-server:
+    image: restic/restic:latest
+    container_name: restic-server
+    restart: always 
+    user: "0:0"
+    command: ["server", "--listen", ":8080", "--repo", "/data", "--tls-cert", "", "--tls-key", ""]
    environment:
      - TZ=America/Montreal
-      - KOPIA_PASSWORD=${KOPIA_PASSWORD}
-      - USER=${KOPIA_USER}
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
    volumes:
-      - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
-      - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
-      - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
-      # Required if you want to use the 'Mount' feature later
-      - /tmp:/tmp:shared
-      # Required for mounting backups as drives
-    cap_add:
-      - SYS_ADMIN
-    devices:
-      - /dev/fuse:/dev/fuse
+      - /mnt/HoardingCow_docker_data/Restic/data:/data
+      # Mount paths to backup (adjust as needed)
+      - /mnt/HoardingCow_docker_data:/source:ro
    networks:
-      - traefik-net
+      - backup_net
+    labels:
+      - "traefik.enable=false" # Internal only, accessed by restic-browser
+
+  restic-browser:
+    image: embergarage/restic-browser:latest
+    container_name: restic-browser
+    restart: always 
+    environment:
+      - TZ=America/Montreal
+      - RESTIC_REPOSITORY=http://restic-server:8080
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+    networks:
+      - backup_net
    labels:
      - "traefik.enable=true"
      # 1. HTTP to HTTPS Redirect
-      - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.kopia-http.entrypoints=web"
-      - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser-http.entrypoints=web"
+      - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
      
      # 2. HTTPS Configuration
-      - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.kopia.entrypoints=websecure"
-      - "traefik.http.routers.kopia.tls=true"
-      - "traefik.http.routers.kopia.tls.certresolver=njalla"
+      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser.entrypoints=websecure"
+      - "traefik.http.routers.restic-browser.tls=true"
+      - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
      
      # 3. Backend Service Config
-      - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+      - "traefik.http.services.restic-browser.loadbalancer.server.port=8000"

 networks:
-  traefik-net:
+  backup_net:
    external: true
+    name: backup_net
--- a/cloudstorage/compose.yml
+++ b/cloudstorage/compose.yml
@@ -5,7 +5,7 @@ services:
    container_name: nextcloud
    restart: always
    networks:
-      - traefik-net
+      - cloud_net
    environment:
      - PUID=1000
      - PGID=1000
@@ -49,9 +49,9 @@ services:
  nextcloud_cron:
    image: nextcloud:latest
    container_name: nextcloud_cron
-    restart: always
+    restart: always 
    networks:
-      - traefik-net
+      - cloud_net
    entrypoint: /cron.sh
    volumes:
      - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
@@ -61,9 +61,9 @@ services:
  nextcloud_mariadb:
    image: mariadb:latest
    container_name: nextcloud_mariadb
-    restart: always
+    restart: unless-stopped
    networks:
-      - traefik-net
+      - cloud_internal
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_USER=nextcloud
@@ -74,5 +74,9 @@ services:
    # command: ["--innodb-force-recovery=6"]

 networks:
-  traefik-net:
+  cloud_net:
    external: true
+    name: cloud_net
+  cloud_internal:
+    driver: bridge
+    name: cloud_internal
--- a/coms/compose.yml
+++ b/coms/compose.yml
@@ -1,15 +1,75 @@
 version: "3.9"
 services:
-  nomadnet:
-    image: ghcr.io/markqvist/nomadnet:master
-    container_name: nomadnet
-    restart: unless-stopped
+  # nomadnet:
+  #   image: ghcr.io/markqvist/nomadnet:master
+  #   container_name: nomadnet
+  #   restart: always
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
+  #     - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
+  #   # Reticulum transport must be reachable directly (NOT through Traefik)
+  #   ports:
+  #     - "4242:4242"
+
+  synapse:
+    image: ghcr.io/element-hq/synapse:latest
+    container_name: synapse
+    restart: always
    volumes:
-      - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
-      - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
-    # Reticulum transport must be reachable directly (NOT through Traefik)
-    ports:
-      - "4242:4242"
+      - /mnt/HoardingCow_docker_data/Matrix/data:/data
+    networks:
+      - coms_net
+      - coms_backend
+    depends_on:
+      synapse-db:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.matrix-http.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-http.entrypoints=web"
+      - "traefik.http.routers.matrix-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.matrix-https.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-https.entrypoints=websecure"
+      - "traefik.http.routers.matrix-https.tls=true"
+      - "traefik.http.routers.matrix-https.tls.certresolver=njalla"
+      - "traefik.http.services.matrix-https.loadbalancer.server.port=8008"
+      - "traefik.docker.network=coms_net"
+
+  synapse-db:
+    image: postgres:17-alpine
+    container_name: synapse-db
+    restart: always
+    environment:
+      - POSTGRES_USER=synapse
+      - POSTGRES_PASSWORD=${SYNAPSE_DB_PASSWORD}
+      - POSTGRES_DB=synapse
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - /mnt/HoardingCow_docker_data/Matrix/db:/var/lib/postgresql/data
+    networks:
+      - coms_backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      
+  synapse-admin:
+    image: awesometechnologies/synapse-admin:latest
+    container_name: synapse-admin
+    restart: always
+    networks:
+      - coms_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-http.entrypoints=web"
+      - "traefik.http.routers.synapse-admin-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-https.entrypoints=websecure"
+      - "traefik.http.routers.synapse-admin-https.tls=true"
+      - "traefik.http.routers.synapse-admin-https.tls.certresolver=njalla"
+      - "traefik.http.services.synapse-admin.loadbalancer.server.port=80"

  # rbrowser:
  #   build: 
@@ -42,5 +102,9 @@ services:
  #     - "traefik.http.services.rns.loadbalancer.server.port=5000"

 networks:
-  traefik-net:
+  coms_net:
    external: true
+    name: coms_net
+  coms_backend:
+    driver: bridge
+    name: coms_backend
--- a/finance/compose.yml
+++ b/finance/compose.yml
@@ -4,18 +4,13 @@ services:
  fava:
    image: yegle/fava
    container_name: fava
-
    environment:
      - BEANCOUNT_FILE=/data/beancount_finance_vault/ledger/main/tpouplier.beancount
-
    volumes:
      - /mnt/HoardingCow_docker_data/Fava:/data
-
    networks:
-      - traefik-net
-
-    restart: unless-stopped
-
+      - finance_net
+    restart: always
    labels:
      - "traefik.enable=true"

@@ -41,5 +36,5 @@ services:
      - "traefik.http.services.fava.loadbalancer.server.port=5000"

 networks:
-  traefik-net:
+  finance_net:
    external: true
--- a/homeautomation/compose.yml
+++ b/homeautomation/compose.yml
@@ -3,7 +3,7 @@ services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
-    restart: unless-stopped
+    restart: always
    privileged: true
    # Was needed for someting.. but dont remember. Deactivated for now.
    # network_mode: host  # Discovery (mDNS/Bluetooth) requires this
@@ -12,7 +12,8 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Home_Assistant:/config:rw
    networks:
-      - traefik-net
+      - home_auto_net
+      - home_auto_backend
    labels:
      - "traefik.enable=true"

@@ -33,7 +34,7 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Mosquitto:/mosquitto
    networks:
-      - traefik-net
+      - home_auto_backend
    # ports:
    #   - 1883:1883
    #   - 9001:9001
@@ -42,7 +43,7 @@ services:
    image: registry.gitlab.com/hydroqc/hydroqc2mqtt:1.3.0
    restart: always
    networks:
-      - traefik-net
+      - home_auto_backend
    environment:
      MQTT_USERNAME: hass
      MQTT_PASSWORD: ${MQTT_PASSWORD}
@@ -87,5 +88,8 @@ services:
  #   restart: unless-stopped

 networks:
-  traefik-net:
+  home_auto_net:
    external: true
+  home_auto_backend:
+    driver: bridge
+    name: home_auto_backend
--- a/homepage/compose.yml
+++ b/homepage/compose.yml
@@ -9,9 +9,9 @@ services:
      - PORT=8080
    volumes:
      - /mnt/HoardingCow_docker_data/Homer/assets:/www/assets:rw
-    restart: unless-stopped
+    restart: always
    networks:
-      - traefik-net
+      - homepage_net
    labels:
      - "traefik.enable=true"

@@ -37,5 +37,5 @@ services:
      - "traefik.http.services.homer.loadbalancer.server.port=8080"

 networks:
-  traefik-net:
+  homepage_net:
    external: true
--- a/network/compose.yml
+++ b/network/compose.yml
@@ -7,31 +7,46 @@ services:
    command:
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.sshnode.address=:2425"

      - "--certificatesresolvers.njalla.acme.email=thierrypouplier@gmail.com"
      - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.njalla.acme.httpchallenge.entrypoint=web"

-      - "--log.level=DEBUG"
+      - "--log.level=INFO"
+      - "--log.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
      - "--providers.docker=true"
      - "--providers.docker.exposedByDefault=false"
    ports:
      - "80:80"
      - "443:443"
    environment:
-      - NJALLA_TOKEN=${NJALLA_TOKEN}
+      - NJALLA_TOKEN=***
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
+      - /var/log/traefik:/var/log/traefik
    restart: unless-stopped
    networks:
-      - traefik-net
+      - traefik_backend
+      - ai_net
+      - auth_net
+      - backup_net
+      - cloud_net
+      - coms_net
+      - finance_net
+      - home_auto_net
+      - homepage_net
+      - passman_net
+      - tak_net
+      - vc_net

  ddns-updater:
    image: qmcgaw/ddns-updater
    container_name: ddns-updater
    networks:
-      - traefik-net
+      - traefik_backend
    ports:
      - 8000:8000/tcp
    volumes:
@@ -63,9 +78,42 @@ services:
    restart: unless-stopped

 networks:
-  traefik-net:
+  traefik_backend:
    driver: bridge
-    name: traefik-net
+    name: traefik_backend
+  ai_net:
+    external: true
+    name: ai_net
+  auth_net:
+    external: true
+    name: auth_net
+  backup_net:
+    external: true
+    name: backup_net
+  cloud_net:
+    external: true
+    name: cloud_net
+  coms_net:
+    external: true
+    name: coms_net
+  finance_net:
+    external: true
+    name: finance_net
+  home_auto_net:
+    external: true
+    name: home_auto_net
+  homepage_net:
+    external: true
+    name: homepage_net
+  passman_net:
+    external: true
+    name: passman_net
+  tak_net:
+    external: true
+    name: tak_net
+  vc_net:
+    external: true
+    name: vc_net

  # duckdns:
  #   environment:
--- a/passwordmanager/compose.yml
+++ b/passwordmanager/compose.yml
@@ -13,8 +13,8 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
    networks:
-      - traefik-net
-    restart: unless-stopped
+      - passman_net
+    restart: always
    labels:
      - "traefik.enable=true"

@@ -32,5 +32,5 @@ services:
      # Internal service
      - "traefik.http.services.pass.loadbalancer.server.port=80"
 networks:
-  traefik-net:
+  passman_net:
    external: true
--- a/tak/compose.yml
+++ b/tak/compose.yml
@@ -3,9 +3,9 @@ services:
    image: ghcr.io/freetakteam/freetakserver:master
    container_name: freetakserver
    hostname: freetakserver
-    restart: unless-stopped
+    restart: always
    networks:
-      - traefik-net
+      - tak_backend
    volumes:
      - /mnt/HoardingCow_docker_data/TAK/fts_data:/opt/fts:z,rw
    ports:
@@ -50,9 +50,9 @@ services:
    image: ghcr.io/freetakteam/ui:latest
    container_name: freetakserver-ui
    hostname: freetakserver-ui
-    restart: unless-stopped
+    restart: always
    networks:
-      - traefik-net
+      - tak_net
    ports:
      - 5000:5000
    volumes:
@@ -91,5 +91,8 @@ services:
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

 networks:
-  traefik-net:
+  tak_net:
    external: true
+  tak_backend:
+    driver: bridge
+    name: tak_backend
--- a/versioncontrol/compose.yml
+++ b/versioncontrol/compose.yml
@@ -12,8 +12,8 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Gitea:/data
    networks:
-      - traefik-net
-    restart: unless-stopped
+      - vc_net
+    restart: always
    ports:
      - "2222:2222"
    labels:
@@ -41,5 +41,5 @@ services:
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

 networks:
-  traefik-net:
+  vc_net:
    external: true
--- a/vpn/Dockerfile
+++ b/vpn/Dockerfile
@@ -0,0 +1,16 @@
+# Custom wg-easy with iptables-nft (nftables-backed iptables)
+# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
+FROM weejewel/wg-easy:latest
+
+# Alpine's iptables-nft provides iptables that uses nftables kernel API
+# instead of the legacy iptable_nat module. This works on kernels
+# where only nftables netfilter modules are available.
+RUN apk add --no-cache iptables-nft
+
+# Ensure iptables-nft takes priority over legacy iptables
+RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
+    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
+    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
+    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
+    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
+    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore
--- a/vpn/compose.yml
+++ b/vpn/compose.yml
@@ -0,0 +1,38 @@
+version: "3.8"
+
+services:
+  wireguard:
+    build:
+      context: ./vpn
+      dockerfile: Dockerfile
+    image: wg-easy-iptables-nft:latest
+    container_name: wireguard
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      - WG_HOST=vpn.lazyworkhorse.net
+      - PASSWORD=${WG_PASSWORD}
+      - WG_PORT=51820
+      - WG_DEFAULT_ADDRESS=10.8.0.x
+      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
+      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
+      - WG_PERSISTENT_KEEPALIVE=25
+      - UI_TRAFFIC_STATS=true
+      - UI_CHART_TYPE=0
+    ports:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
+    volumes:
+      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+    restart: unless-stopped
+    networks:
+      - vpn_net
+
+networks:
+  vpn_net:
+    external: true
+    name: vpn_net
Author	SHA1	Message	Date
Hermes	5e242eb946	fix: add iptables-nft to wg-easy for nftables-only kernels wg-easy's Alpine wg-quick uses legacy iptables which requires the iptable_nat kernel module. On NixOS kernels compiled without legacy netfilter modules, the container crashes in a restart loop: iptables v1.8.3 (legacy): can't initialize iptables table 'nat' Table does not exist (do you need to insmod?) Fix: build a custom image that installs Alpine's iptables-nft package and symlinks iptables -> iptables-nft (nftables backend).	2026-05-12 14:52:33 -04:00
Thierry Pouplier	d97f1cb1e5	fix: add startup permission fix for data volume (chown critical dirs on boot)	2026-05-09 16:04:32 +00:00
Thierry Pouplier	1a1cfec80a	fix: add atomic write permission fix (preserves file mode on os.replace)	2026-05-09 15:50:29 +00:00
Thierry Pouplier	90e227bc4e	feat: switch back to Ryan high quality voice	2026-05-09 15:21:49 +00:00
Thierry Pouplier	8e9a75fe5c	fix: remove patch step from Dockerfile (build context is just ai/)	2026-05-09 14:28:35 +00:00
Thierry Pouplier	3016d0da2c	fix: patch source tts_tool.py path, not site-packages	2026-05-09 14:27:07 +00:00
Thierry Pouplier	b750d26d80	feat: switch to Norman voice (US male, medium)	2026-05-09 14:20:46 +00:00
Thierry Pouplier	0a9507de65	fix: add ca-certificates for HuggingFace download	2026-05-09 14:14:52 +00:00
Thierry Pouplier	b3fa424661	fix: correct COPY path for patch_tts_tool.py (build context is ai/)	2026-05-09 14:12:06 +00:00
Thierry Pouplier	77fe8133ae	fix: Dockerfile heredoc for voice download instead of multi-line -c	2026-05-09 14:09:50 +00:00
Thierry Pouplier	3f080da35e	fix: clean patch script - only target Edge, no Coqui references	2026-05-09 13:59:09 +00:00
Thierry Pouplier	78f499bde8	fix: use full OPENROUTER_API_KEY variable name	2026-05-09 13:55:38 +00:00
Thierry Pouplier	e779818e73	chore: remove pycache	2026-05-09 13:41:54 +00:00
Thierry Pouplier	25d7611043	fix: clean Dockerfile with Piper TTS, external patch script	2026-05-09 13:41:37 +00:00
Thierry Pouplier	28213eec5c	fix: replace Coqui/ROCm with Piper TTS (simpler, local, CPU)	2026-05-09 13:24:08 +00:00
Thierry Pouplier	c2471818b2	feat: add ROCm + Coqui TTS with GPU support to Dockerfile	2026-05-09 04:09:57 +00:00
Thierry Pouplier	f5171a7d6e	fix: replace Dockerfile with simplified stable-slim version	2026-05-09 02:38:30 +00:00
Thierry Pouplier	5c504501d3	feat: add ROCm GPU env vars to hermes service for faster-whisper STT	2026-05-09 00:20:57 +00:00
Thierry Pouplier	2fa481909f	Merge pull request 'feat: add WireGuard VPN stack (wg-easy)' (#16 ) from feat/wireguard-vpn into master Reviewed-on: #16	2026-05-09 00:11:56 +00:00
Thierry Pouplier	434b2835ff	Merge remote-tracking branch 'origin/feat/wireguard-vpn' into HEAD	2026-05-04 23:05:09 -04:00
Thierry Pouplier	51cf83c420	Commeneted nomadnet for now. not usingit.	2026-05-04 23:01:58 -04:00
Thierry Pouplier	d9f62652cb	Commented webui for now. now using it	2026-05-04 22:56:07 -04:00
Thierry Pouplier	bc49391b4f	chore: clean up WireGuard from Hermes Dockerfile, keep custom build	2026-05-05 02:11:37 +00:00
Thierry Pouplier	acf45acdd9	feat: enable NET_ADMIN for Hermes container to support WireGuard	2026-05-05 01:48:21 +00:00
Thierry Pouplier	b021d0dba7	feat: add custom Hermes Dockerfile with WireGuard tools	2026-05-05 01:42:55 +00:00
Thierry Pouplier	eea6db3ceb	feat: add WireGuard VPN stack (wg-easy, named wireguard)	2026-05-05 01:21:31 +00:00
Thierry Pouplier	4a57ca69b2	fix: switch to linuxserver/wireguard instead of wg-easy	2026-05-05 01:17:57 +00:00
Thierry Pouplier	293429a124	feat: add WireGuard VPN stack with wg-easy	2026-05-04 22:46:50 +00:00
Thierry Pouplier	1b0dbed52e	Merge pull request 'feat: enable traefik access logs for fail2ban http jails' (#15 ) from feat/traefik-access-logs-for-fail2ban into master - Reviewed-on: #15 - Tested on the host	2026-05-01 12:18:22 +00:00
Thierry Pouplier	a79fe9dffa	feat: enable traefik access logs for fail2ban http jails	2026-05-01 03:06:14 +00:00
Thierry Pouplier	fb0f2cbe84	Network reorganization, multiple updates	2026-04-27 05:47:46 -04:00