fix(paperclip): force Traefik to use ai_net network for routing

Revert custom Dockerfile - not needed, adapter installs on persistent volume
The Hermes adapter can be installed once via Paperclip's adapter management API and persists on the Docker volume across restarts. No custom Dockerfile or build step required.
2026-05-18 22:13:59 -04:00 · 2026-05-18 18:38:17 -04:00 · 2026-05-18 18:37:31 -04:00 · 2026-05-18 18:17:15 -04:00
15 changed files with 107 additions and 118 deletions
--- a/.env.production
+++ b/.env.production
@@ -1,4 +0,0 @@
-# Production environment
-# docker compose --env-file .env.production up -d
-DOMAIN=lazyworkhorse.net
-SITE_URL=https://lazyworkhorse.net
--- a/.env.staging
+++ b/.env.staging
@@ -1,4 +0,0 @@
-# Staging environment
-# docker compose --env-file .env.staging up -d
-DOMAIN=staging.lazyworkhorse.net
-SITE_URL=https://staging.lazyworkhorse.net
--- a/33
+++ b/33
@@ -1,18 +1,13 @@
 # Base path for docker-compose files
-COMPOSE_PATH?=~/Projects/AltNet/docker-compose
-
-# Environment selection: staging or production (default)
-ENV?=production
-ENV_FILE=.env.$(ENV)
+COMPOSE_PATH=~/Projects/AltNet/docker-compose

 # List of services (folder names)
 SERVICES=monitoring ai cloudstorage crm_tp crm_cf mediacenter homeautomation network backup homepage passwordmanager

 # Bring up all services
 all_up:
-	@echo "Deploying with $(ENV) environment ($(ENV_FILE))..."
 	@for service in $(SERVICES); do \
-		docker compose --env-file $(ENV_FILE) -f $(COMPOSE_PATH)/$$service/compose.yml up -d; \
+		docker compose -f $(COMPOSE_PATH)/$$service/compose.yml up -d; \
 	done

 # Bring down all services
@@ -23,27 +18,15 @@ all_down:

 # Generic target to deploy a specific service
 %_up:
-	@echo "Deploying $* with $(ENV) environment ($(ENV_FILE))..."
-	@docker compose --env-file $(ENV_FILE) -f $(COMPOSE_PATH)/$*/compose.yml up -d
+	@docker compose -f $(COMPOSE_PATH)/$*/compose.yml up -d

 # Generic target to bring down a specific service
 %_down:
 	@docker compose -f $(COMPOSE_PATH)/$*/compose.yml down

-# Deploy staging (all services)
-staging:
-	@$(MAKE) all_up ENV=staging
-
-# Deploy production (all services)
-production:
-	@$(MAKE) all_up ENV=production
-
-# Staging per-service: make openwebui_up ENV=staging
-# Production per-service: make openwebui_up ENV=production
-
 all_stack_up:
 	@for service in $(SERVICES); do \
-		docker stack deploy --env-file $(ENV_FILE) -c $(COMPOSE_PATH)/$$service/compose.yml $$service; \
+		docker stack deploy -c $(COMPOSE_PATH)/$$service/compose.yml $$service; \
 	done

 all_stack_down:
@@ -52,7 +35,7 @@ all_stack_down:
 	done

 %_stack_up:
-	@docker stack deploy --env-file $(ENV_FILE) -c $(COMPOSE_PATH)/$*/compose.yml $*
+	@docker stack deploy -c $(COMPOSE_PATH)/$*/compose.yml $*

 %_stack_down:
 	@docker stack rm $*
@@ -60,9 +43,3 @@ all_stack_down:
 stack_ls:
 	@docker node ps workGoat;
 	docker node ps workHorse
-
-# Show current environment settings
-env:
-	@echo "Active environment: $(ENV)"
-	@echo "Env file: $(ENV_FILE)"
-	@test -f $(ENV_FILE) && cat $(ENV_FILE) || echo "WARNING: $(ENV_FILE) not found!"
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -15,12 +15,12 @@ services:
  #     - "traefik.enable=true"

  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.${DOMAIN}`)"
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
  #     - "traefik.http.routers.webui-http.entrypoints=web"
  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"

  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.${DOMAIN}`)"
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
  #     - "traefik.http.routers.webui-https.tls=true"
  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
@@ -54,10 +54,6 @@ services:
      - TZ=America/Montreal
    volumes:
      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      # Syncthing-shared org files — read-only view of user's agenda
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
-      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
@@ -67,35 +63,6 @@ services:
    networks:
      - ai_backend

-  syncthing:
-    image: syncthing/syncthing:latest
-    container_name: syncthing
-    hostname: syncthing
-    restart: always
-    ports:
-      - "8384:8384"
-      - "22000:22000"
-      - "21027:21027/udp"
-    environment:
-      - TZ=America/Montreal
-    volumes:
-      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
-    networks:
-      - ai_backend
-      - ai_net
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.${DOMAIN}`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.${DOMAIN}`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.tls=true"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
-      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
-
  ollama:
    build:
      context: ./ollama
@@ -129,6 +96,62 @@ services:
      - "303"
      - "26"

+  paperclip-db:
+    image: postgres:17-alpine
+    container_name: paperclip-db
+    restart: always
+    environment:
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
+    networks:
+      - ai_backend
+
+  paperclip:
+    image: ghcr.io/paperclipai/paperclip:v2026.517.0
+    container_name: paperclip
+    restart: always
+    ports:
+      - "127.0.0.1:3100:3100"
+    environment:
+      - HOST=0.0.0.0
+      - PORT=3100
+      - SERVE_UI=true
+      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
+      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
+      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
+      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
+    depends_on:
+      paperclip-db:
+        condition: service_healthy
+    networks:
+      - ai_net
+      - ai_backend
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
+      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-http.entrypoints=web"
+      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
+      - "traefik.http.routers.paperclip-https.tls=true"
+      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
+
 networks:
  ai_net:
    external: true
@@ -232,12 +255,12 @@ networks:
  #   networks:
  #     - ai_net
  #   environment:
-  #     - N8N_HOST=n8n.${DOMAIN}
+  #     - N8N_HOST=n8n.lazyworkhorse.net
  #     - N8N_PORT=5678
  #     - N8N_PROTOCOL=https
  #     - NODE_ENV=production
  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-  #     - WEBHOOK_URL=https://n8n.${DOMAIN}/
+  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
@@ -251,12 +274,12 @@ networks:
  #     - "traefik.enable=true"

  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.${DOMAIN}`)"
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
  #     - "traefik.http.routers.n8n-http.entrypoints=web"
  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"

  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.${DOMAIN}`)"
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
  #     - "traefik.http.routers.n8n-https.tls=true"
  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
@@ -286,15 +309,15 @@ networks:
  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
  #     - BROWSER_EVALUATE_ENABLED=true
  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
-  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.${DOMAIN}
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
  #   labels:
  #     - "traefik.enable=true"

-  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.${DOMAIN}`)"
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"

-  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.${DOMAIN}`)"
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
  #     - "traefik.http.routers.openclaw-https.priority=50"
  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
  #     - "traefik.http.routers.openclaw-https.tls=true"
--- a/authentification/compose.yml
+++ b/authentification/compose.yml
@@ -13,12 +13,12 @@ services:
      - "traefik.enable=true"

      # HTTP router
-      - "traefik.http.routers.authelia-http.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authelia-http.rule=Host(`auth.lazyworkhorse.net`)"
      - "traefik.http.routers.authelia-http.entrypoints=web"
      - "traefik.http.routers.authelia-http.middlewares=redirect-to-https"

      # HTTPS router
-      - "traefik.http.routers.authelia-https.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authelia-https.rule=Host(`auth.lazyworkhorse.net`)"
      - "traefik.http.routers.authelia-https.entrypoints=websecure"
      - "traefik.http.routers.authelia-https.tls=true"
      - "traefik.http.routers.authelia-https.tls.certresolver=njalla"
@@ -26,7 +26,7 @@ services:
      - "traefik.http.services.authelia.loadbalancer.server.port=9091"

      # forward auth middleware definition
-      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}"
+      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net"
      - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"

--- a/backup/compose.yml
+++ b/backup/compose.yml
@@ -37,12 +37,12 @@ services:
  #   labels:
  #     - "traefik.enable=true"
  #     # 1. HTTP to HTTPS Redirect
-  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.${DOMAIN}`)"
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
  #     - "traefik.http.routers.kopia-http.entrypoints=web"
  #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
  #     
  #     # 2. HTTPS Configuration
-  #     - "traefik.http.routers.kopia.rule=Host(`backup.${DOMAIN}`)"
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
  #     - "traefik.http.routers.kopia.entrypoints=websecure"
  #     - "traefik.http.routers.kopia.tls=true"
  #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
@@ -81,12 +81,12 @@ services:
    labels:
      - "traefik.enable=true"
      # 1. HTTP to HTTPS Redirect
-      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.${DOMAIN}`)"
+      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
      - "traefik.http.routers.restic-browser-http.entrypoints=web"
      - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
      
      # 2. HTTPS Configuration
-      - "traefik.http.routers.restic-browser.rule=Host(`backup.${DOMAIN}`)"
+      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
      - "traefik.http.routers.restic-browser.entrypoints=websecure"
      - "traefik.http.routers.restic-browser.tls=true"
      - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
--- a/cloudstorage/compose.yml
+++ b/cloudstorage/compose.yml
@@ -17,8 +17,8 @@ services:
      - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
      # Reverse Proxy Overrides (Crucial for HTTPS behind Traefik)
      - OVERWRITEPROTOCOL=https
-      - OVERWRITECLIURL=https://cloud.${DOMAIN}
-      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.${DOMAIN}
+      - OVERWRITECLIURL=https://cloud.lazyworkhorse.net
+      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.lazyworkhorse.net
    volumes:
      - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
    depends_on:
@@ -27,12 +27,12 @@ services:
      - "traefik.enable=true"

      # Router for HTTP -> HTTPS Redirection (Matching your Gitea style)
-      - "traefik.http.routers.nextcloud-http.rule=Host(`cloud.${DOMAIN}`)"
+      - "traefik.http.routers.nextcloud-http.rule=Host(`cloud.lazyworkhorse.net`)"
      - "traefik.http.routers.nextcloud-http.entrypoints=web"
      - "traefik.http.routers.nextcloud-http.middlewares=redirect-to-https"

      # Router for HTTPS
-      - "traefik.http.routers.nextcloud-https.rule=Host(`cloud.${DOMAIN}`)"
+      - "traefik.http.routers.nextcloud-https.rule=Host(`cloud.lazyworkhorse.net`)"
      - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-https.tls=true"
      - "traefik.http.routers.nextcloud-https.tls.certresolver=njalla"
--- a/coms/compose.yml
+++ b/coms/compose.yml
@@ -25,10 +25,10 @@ services:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.matrix-http.rule=Host(`matrix.${DOMAIN}`)"
+      - "traefik.http.routers.matrix-http.rule=Host(`matrix.lazyworkhorse.net`)"
      - "traefik.http.routers.matrix-http.entrypoints=web"
      - "traefik.http.routers.matrix-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.matrix-https.rule=Host(`matrix.${DOMAIN}`)"
+      - "traefik.http.routers.matrix-https.rule=Host(`matrix.lazyworkhorse.net`)"
      - "traefik.http.routers.matrix-https.entrypoints=websecure"
      - "traefik.http.routers.matrix-https.tls=true"
      - "traefik.http.routers.matrix-https.tls.certresolver=njalla"
@@ -62,10 +62,10 @@ services:
      - coms_net
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.${DOMAIN}`)"
+      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.lazyworkhorse.net`)"
      - "traefik.http.routers.synapse-admin-http.entrypoints=web"
      - "traefik.http.routers.synapse-admin-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.${DOMAIN}`)"
+      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.lazyworkhorse.net`)"
      - "traefik.http.routers.synapse-admin-https.entrypoints=websecure"
      - "traefik.http.routers.synapse-admin-https.tls=true"
      - "traefik.http.routers.synapse-admin-https.tls.certresolver=njalla"
@@ -88,12 +88,12 @@ services:
  #     - "traefik.enable=true"
  #
  #     # HTTP → HTTPS
-  #     - "traefik.http.routers.rns-http.rule=Host(`nomad.${DOMAIN}`)"
+  #     - "traefik.http.routers.rns-http.rule=Host(`nomad.lazyworkhorse.net`)"
  #     - "traefik.http.routers.rns-http.entrypoints=web"
  #     - "traefik.http.routers.rns-http.middlewares=redirect-to-https"
  #
  #     # HTTPS protected by Authelia
-  #     - "traefik.http.routers.rns-https.rule=Host(`nomad.${DOMAIN}`)"
+  #     - "traefik.http.routers.rns-https.rule=Host(`nomad.lazyworkhorse.net`)"
  #     - "traefik.http.routers.rns-https.entrypoints=websecure"
  #     - "traefik.http.routers.rns-https.tls=true"
  #     - "traefik.http.routers.rns-https.tls.certresolver=njalla"
--- a/finance/compose.yml
+++ b/finance/compose.yml
@@ -15,20 +15,20 @@ services:
      - "traefik.enable=true"

      # HTTP → HTTPS redirect
-      - "traefik.http.routers.fava-http.rule=Host(`money.${DOMAIN}`)"
+      - "traefik.http.routers.fava-http.rule=Host(`money.lazyworkhorse.net`)"
      - "traefik.http.routers.fava-http.entrypoints=web"
      - "traefik.http.routers.fava-http.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      # HTTPS router protected by Authelia
-      - "traefik.http.routers.fava-https.rule=Host(`money.${DOMAIN}`)"
+      - "traefik.http.routers.fava-https.rule=Host(`money.lazyworkhorse.net`)"
      - "traefik.http.routers.fava-https.entrypoints=websecure"
      - "traefik.http.routers.fava-https.tls=true"
      - "traefik.http.routers.fava-https.tls.certresolver=njalla"
      - "traefik.http.routers.fava-https.middlewares=fava-auth"

      # Authelia forwardAuth
-      - "traefik.http.middlewares.fava-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
+      - "traefik.http.middlewares.fava-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
      - "traefik.http.middlewares.fava-auth.forwardauth.trustforwardheader=true"
      - "traefik.http.middlewares.fava-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"

--- a/homeautomation/compose.yml
+++ b/homeautomation/compose.yml
@@ -17,11 +17,11 @@ services:
    labels:
      - "traefik.enable=true"

-      - "traefik.http.routers.hass-http.rule=Host(`home.${DOMAIN}`)"
+      - "traefik.http.routers.hass-http.rule=Host(`home.lazyworkhorse.net`)"
      - "traefik.http.routers.hass-http.entrypoints=web"
      - "traefik.http.routers.hass-http.middlewares=redirect-to-https"

-      - "traefik.http.routers.hass-https.rule=Host(`home.${DOMAIN}`)"
+      - "traefik.http.routers.hass-https.rule=Host(`home.lazyworkhorse.net`)"
      - "traefik.http.routers.hass-https.entrypoints=websecure"
      - "traefik.http.routers.hass-https.tls.certresolver=njalla"

--- a/homepage/compose.yml
+++ b/homepage/compose.yml
@@ -16,20 +16,20 @@ services:
      - "traefik.enable=true"

      # HTTP → HTTPS redirect
-      - "traefik.http.routers.homer-http.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.homer-http.rule=Host(`lazyworkhorse.net`)"
      - "traefik.http.routers.homer-http.entrypoints=web"
      - "traefik.http.routers.homer-http.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      # HTTPS router protected by Authelia
-      - "traefik.http.routers.homer-https.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.homer-https.rule=Host(`lazyworkhorse.net`)"
      - "traefik.http.routers.homer-https.entrypoints=websecure"
      - "traefik.http.routers.homer-https.tls=true"
      - "traefik.http.routers.homer-https.tls.certresolver=njalla"
      - "traefik.http.routers.homer-https.middlewares=homer-auth"

      # Authelia forwardAuth
-      - "traefik.http.middlewares.homer-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
+      - "traefik.http.middlewares.homer-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
      - "traefik.http.middlewares.homer-auth.forwardauth.trustforwardheader=true"
      - "traefik.http.middlewares.homer-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"

--- a/passwordmanager/compose.yml
+++ b/passwordmanager/compose.yml
@@ -9,10 +9,7 @@ services:
      - TZ=America/Montreal
      - WEBSOCKET_ENABLED=true
      - SIGNUPS_ALLOWED=false
-      # Vaultwarden env var DOMAIN — the ${DOMAIN} on the RHS is expanded
-      # by docker compose before the env var is set, so this resolves to
-      # DOMAIN=https://pass.lazyworkhorse.net in production.
-      - DOMAIN=https://pass.${DOMAIN}
+      - DOMAIN=https://pass.lazyworkhorse.net
    volumes:
      - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
    networks:
@@ -22,12 +19,12 @@ services:
      - "traefik.enable=true"

      # HTTP → HTTPS
-      - "traefik.http.routers.pass-http.rule=Host(`pass.${DOMAIN}`)"
+      - "traefik.http.routers.pass-http.rule=Host(`pass.lazyworkhorse.net`)"
      - "traefik.http.routers.pass-http.entrypoints=web"
      - "traefik.http.routers.pass-http.middlewares=redirect-to-https"

      # HTTPS
-      - "traefik.http.routers.pass-https.rule=Host(`pass.${DOMAIN}`)"
+      - "traefik.http.routers.pass-https.rule=Host(`pass.lazyworkhorse.net`)"
      - "traefik.http.routers.pass-https.entrypoints=websecure"
      - "traefik.http.routers.pass-https.tls=true"
      - "traefik.http.routers.pass-https.tls.certresolver=njalla"
--- a/tak/compose.yml
+++ b/tak/compose.yml
@@ -74,12 +74,12 @@ services:
      - "traefik.docker.network=traefik-net"

      # HTTP -> HTTPS Redirect
-      - "traefik.http.routers.fts-ui-http.rule=Host(`tak.${DOMAIN}`)"
+      - "traefik.http.routers.fts-ui-http.rule=Host(`tak.lazyworkhorse.net`)"
      - "traefik.http.routers.fts-ui-http.entrypoints=web"
      - "traefik.http.routers.fts-ui-http.middlewares=redirect-to-https"

      # HTTPS Router
-      - "traefik.http.routers.fts-ui-https.rule=Host(`tak.${DOMAIN}`)"
+      - "traefik.http.routers.fts-ui-https.rule=Host(`tak.lazyworkhorse.net`)"
      - "traefik.http.routers.fts-ui-https.entrypoints=websecure"
      - "traefik.http.routers.fts-ui-https.tls=true"
      - "traefik.http.routers.fts-ui-https.tls.certresolver=njalla"
--- a/versioncontrol/compose.yml
+++ b/versioncontrol/compose.yml
@@ -6,7 +6,7 @@ services:
    environment:
      - USER_UID=1000
      - USER_GID=1000
-      - GITEA__server__ROOT_URL=https://code.${DOMAIN}
+      - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
      - GITEA__actions__ENABLED=true
      - SSH_PORT=2222
      - SSH_LISTEN_PORT=2222
@@ -23,21 +23,21 @@ services:
      - "traefik.enable=true"

      # HTTP -> HTTPS Redirect
-      - "traefik.http.routers.gitea-http.rule=Host(`code.${DOMAIN}`)"
+      - "traefik.http.routers.gitea-http.rule=Host(`code.lazyworkhorse.net`)"
      - "traefik.http.routers.gitea-http.entrypoints=web"
      - "traefik.http.routers.gitea-http.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

      # HTTPS Router
-      - "traefik.http.routers.gitea-https.rule=Host(`code.${DOMAIN}`)"
+      - "traefik.http.routers.gitea-https.rule=Host(`code.lazyworkhorse.net`)"
      - "traefik.http.routers.gitea-https.entrypoints=websecure"
      - "traefik.http.routers.gitea-https.tls=true"
      - "traefik.http.routers.gitea-https.tls.certresolver=njalla"
      - "traefik.http.routers.gitea-https.middlewares=gitea-home-redirect"

      # The Redirect Logic - Using single quotes to allow backslashes
-      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.regex=^https://code\.${DOMAIN}/?$$'
-      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.replacement=https://code.${DOMAIN}/gortium'
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.regex=^https://code\.lazyworkhorse\.net/?$$'
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.replacement=https://code.lazyworkhorse.net/gortium'
      - "traefik.http.middlewares.gitea-home-redirect.redirectregex.permanent=true"

      # Internal Routing
@@ -47,7 +47,7 @@ services:
    image: gitea/act_runner:latest
    container_name: act_runner
    environment:
-      - GITEA_INSTANCE_URL=https://code.${DOMAIN}
+      - GITEA_INSTANCE_URL=https://code.lazyworkhorse.net
      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
      - GITEA_RUNNER_NAME=ai-host-runner
      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://catthehacker/ubuntu:full-22.04,nixos-builder:docker://nixos/nix
--- a/vpn/compose.yml
+++ b/vpn/compose.yml
@@ -11,7 +11,7 @@ services:
      - NET_ADMIN
      - SYS_MODULE
    environment:
-      - WG_HOST=vpn.${DOMAIN}
+      - WG_HOST=vpn.lazyworkhorse.net
      - PASSWORD=${WG_PASSWORD}
      - WG_PORT=51820
      - WG_DEFAULT_ADDRESS=10.8.0.x
Author	SHA1	Message	Date
Hermes	1eacc3cd8e	fix(paperclip): force Traefik to use ai_net network for routing Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details	2026-05-18 22:13:59 -04:00
Hermes	bce403232a	Revert custom Dockerfile - not needed, adapter installs on persistent volume Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details The Hermes adapter can be installed once via Paperclip's adapter management API and persists on the Docker volume across restarts. No custom Dockerfile or build step required.	2026-05-18 18:38:17 -04:00
Hermes	37bf43c3ea	feat: add custom Dockerfile with Hermes adapter baked in Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details Creates ai/paperclip/ with: - Dockerfile: extends upstream paperclip image, pre-installs hermes-paperclip-adapter@0.3.0 npm package as seed data - docker-entrypoint.sh: seeds the adapter plugin on first boot if the persistent volume is empty, then runs original startup This ensures the Hermes adapter is available on first boot without requiring network access — no npm install needed at runtime. The adapter persists on the Docker volume across restarts.	2026-05-18 18:37:31 -04:00
Hermes	563ccc5632	feat: add Paperclip agent orchestrator to AI compose stack Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details Paperclip (ghcr.io/paperclipai/paperclip:v2026.517.0) is an open-source agent management dashboard. Adds paperclip-db (PostgreSQL 17) and paperclip services with Traefik reverse proxy on paperclip.lazyworkhorse.net. Requires .env: PAPERCLIP_DB_PASSWORD, PAPERCLIP_AUTH_SECRET.	2026-05-18 18:17:15 -04:00