feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support

- Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build - Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs - Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings) Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.
Merge pull request 'feat: add Syncthing service for Hermes org-file sync' (#30 ) from feat/syncthing-org-sync into master
2026-06-11 11:41:42 -04:00 · 2026-05-19 00:28:59 +00:00 · 2026-05-18 20:25:18 -04:00 · 2026-05-14 22:24:19 -04:00 · 2026-05-14 21:40:00 -04:00 · 2026-05-14 21:35:31 -04:00
5 changed files with 104 additions and 73 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -54,6 +54,10 @@ services:
      - TZ=America/Montreal
    volumes:
      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
@@ -63,6 +67,35 @@ services:
    networks:
      - ai_backend

+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
  ollama:
    build:
      context: ./ollama
@@ -79,22 +112,7 @@ services:
      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
    environment:
      - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
      - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=1
-      - OLLAMA_NUM_PARALLEL=2
-    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"

 networks:
  ai_net:
@@ -104,47 +122,40 @@ networks:
    driver: bridge
    name: ai_backend
    
-  # llama_cpp_devstral:
-  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
-  #   container_name: llama_cpp_devstral
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_backend
-  #   ports:
-  #     - "8300:8080"
-  #   ipc: host
-  #   devices:
-  #     - "/dev/kfd:/dev/kfd"
-  #     - "/dev/dri:/dev/dri"
-  #   group_add:
-  #     - "303" # video
-  #     - "26"  # render
-  #   environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
-  #     HIP_VISIBLE_DEVICES: 0,1
-  #     LLAMA_CACHE: /models
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
-  #   command: >
-  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
-  #     -a devstral-2-small-llama_cpp
-  #     --chat-template-file /template.jinja
-  #     --host 0.0.0.0
-  #     --port 8080
-  #     --n-gpu-layers 99
-  #     --ctx-size 163840
-  #     --batch-size 4096
-  #     --ubatch-size 4096
-  #     --cache-type-k f16
-  #     --cache-type-v f16
-  #     --cache-reuse 256
-  #     --flash-attn on
-  #     --context-shift
-  #     --split-mode layer
-  #     --no-mmap
-  #     --n-predict -1
-  #     --parallel 2
+  llama-cpp-hermes:
+    image: llama-cpp:rocm-gfx906
+    container_name: llama-cpp-hermes
+    restart: unless-stopped
+    networks:
+      - ai_backend
+    ports:
+      - "127.0.0.1:8300:8080"
+    ipc: host
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+    environment:
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HSA_ENABLE_SDMA=0
+      - HIP_VISIBLE_DEVICES=0,1
+      - LLAMA_CACHE=/models
+    volumes:
+      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
+    command: >
+      -m /model.gguf
+      --host 0.0.0.0
+      --port 8080
+      --gpu-layers 99
+      --ctx-size 163840
+      -ctk f16 -ctv f16
+      --flash-attn on
+      --split-mode layer
+      --no-mmap
+      --n-predict -1

  # vllm:
  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
--- a/ai/llama-cpp/Dockerfile
+++ b/ai/llama-cpp/Dockerfile
@@ -0,0 +1,30 @@
+# llama-cpp-rocm6/Dockerfile
+# Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
+# Build: docker build -t llama-cpp:rocm-gfx906 .
+
+FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
+ARG LLAMACPP_VERSION=b9596
+RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
+WORKDIR /build
+ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm
+RUN mkdir build && cd build && \
+    cmake .. -DGGML_HIP=ON -DCMAKE_BUILD_TYPE=Release \
+      -DAMDGPU_TARGETS="gfx906:xnack-" \
+      -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+      -DGGML_CUDA=OFF -DGGML_VULKAN=OFF -DGGML_METAL=OFF \
+      -DBUILD_SHARED_LIBS=OFF && \
+    cmake --build . --target llama-server -- -j $(nproc)
+
+FROM ubuntu:24.04
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates curl libstdc++6 libgomp1 libopenblas0 \
+    libnuma1 libelf1 libdrm2 libdrm-amdgpu1 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
+COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
+COPY --from=builder /build/build/bin/llama-server /usr/local/bin/llama-server
+RUN echo /opt/rocm/lib > /etc/ld.so.conf.d/rocm.conf && ldconfig
+ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 HCC_AMDGPU_TARGET=gfx906 HSA_ENABLE_SDMA=0
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/llama-server"]
--- a/versioncontrol/compose.yml
+++ b/versioncontrol/compose.yml
@@ -8,13 +8,10 @@ services:
      - USER_GID=1000
      - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
      - GITEA__actions__ENABLED=true
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
      - SSH_PORT=2222
      - SSH_LISTEN_PORT=2222
      # Enable Gitea Actions (act_runner required on host)
      - GITEA__actions__ENABLED=true
-      # Don't fetch actions from GitHub (offline mode + local only)
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
    volumes:
      - /mnt/HoardingCow_docker_data/Gitea:/data
    networks:
--- a/vpn/Dockerfile
+++ b/vpn/Dockerfile
@@ -1,16 +1,9 @@
 # Custom wg-easy with iptables-nft (nftables-backed iptables)
 # Fixes crash-loop when host kernel lacks legacy iptable_nat module.
-FROM weejewel/wg-easy:latest
+FROM ghcr.io/wg-easy/wg-easy:latest

-# Alpine's iptables-nft provides iptables that uses nftables kernel API
-# instead of the legacy iptable_nat module. This works on kernels
-# where only nftables netfilter modules are available.
-RUN apk add --no-cache iptables-nft
-
-# Ensure iptables-nft takes priority over legacy iptables
-RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
-    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
-    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
-    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
-    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
-    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore
+# The upstream image registers only iptables-legacy with update-alternatives.
+# iptables-nft binary exists but isn't registered as an alternative key.
+# Override the alternatives-managed symlinks directly.
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables
--- a/vpn/compose.yml
+++ b/vpn/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 services:
  wireguard:
    build:
-      context: ./vpn
+      context: .
      dockerfile: Dockerfile
    image: wg-easy-iptables-nft:latest
    container_name: wireguard
Author	SHA1	Message	Date
Hermes	3c92d93366	feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build - Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs - Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings) Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.	2026-06-11 11:41:42 -04:00
Thierry Pouplier	d3f2e3b7b9	Merge pull request 'feat: add Syncthing service for Hermes org-file sync' (#30 ) from feat/syncthing-org-sync into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #30	2026-05-19 00:28:59 +00:00
Thierry Pouplier	6a44120b1a	Fixed syncthing dir path Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details	2026-05-18 20:25:18 -04:00
Thierry Pouplier	38a1451689	Merge branch 'master' into feat/syncthing-org-sync	2026-05-14 22:24:19 -04:00
Hermes	f9fb28d560	fix: route Syncthing web UI through Traefik with HTTPS Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details	2026-05-14 21:40:00 -04:00
Hermes	bcc4b6d157	feat: add Syncthing service for Hermes org-file sync Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details	2026-05-14 21:35:31 -04:00
Thierry Pouplier	8d1ae7e632	Remove the unsuported gitea action off	2026-05-13 13:11:11 -04:00
Thierry Pouplier	29ae32a1c5	Merge pull request 'fix: use ln -sf instead of update-alternatives --set for iptables-nft' (#28 ) from fix/vpn-iptables-nft-v3 into master Reviewed-on: #28	2026-05-13 16:59:50 +00:00
Hermes	8dff094768	fix: use ln -sf instead of update-alternatives --set update-alternatives --set fails because the base image only registers iptables-legacy as an alternative. The iptables-nft binary (/usr/sbin/iptables-nft) exists but isn't in the alternatives database. Direct ln -sf bypasses this.	2026-05-13 12:58:43 -04:00
Thierry Pouplier	ec08f5eb5d	Merge pull request 'fix: remove apk add iptables-nft — built-in on Alpine 3.18+' (#27 ) from fix/vpn-iptables-nft-v2 into master Reviewed-on: #27	2026-05-13 16:49:23 +00:00
Hermes	611e96b306	fix: remove apk add iptables-nft — built-in on Alpine 3.18+ In Alpine 3.18+, the 'iptables' package IS the nftables variant. iptables-nft is not a separate package. The binary is already in the base image — only need to flip update-alternatives.	2026-05-13 12:48:51 -04:00
Thierry Pouplier	f184ed957c	Merge pull request 'fix: update wg-easy to official ghcr image with iptables-nft' (#26 ) from fix/vpn-iptables-nft-upstream into master Reviewed-on: #26	2026-05-13 16:37:35 +00:00
Hermes	2bf31c7ccc	fix: update wg-easy to official ghcr image with iptables-nft - Switch FROM weejewel/wg-easy:latest (4yr old, Alpine 3.11) to ghcr.io/wg-easy/wg-easy:latest (actively maintained, Alpine krypton) - Use update-alternatives instead of raw ln -sf to flip iptables from legacy to nftables backend - Fix compose build context: ./vpn -> . (Dockerfile was at same level) The weejewel/wg-easy image lacked iptables-nft package in Alpine 3.11. The new official image has it available, we just flip the alternatives. The old ln -sf approach was fragile across Alpine versions.	2026-05-13 12:30:15 -04:00