fix: route Syncthing web UI through Traefik with HTTPS

ai/compose.yml

@@ -54,6 +54,10 @@ services:
       - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/org-ro:/opt/data/org-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/org-rw:/opt/data/org-rw:rw
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -63,6 +67,35 @@ services:
     networks:
       - ai_backend
 
+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/org-ro:/org-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/org-rw:/org-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
   ollama:
     build:
       context: ./ollama

ai/hermes/Dockerfile

@@ -78,47 +78,6 @@ PYEOF
 # ---------- Install himalaya-ro wrapper ----------
 COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
 
-# ---------- Install 7-Zip for CHM extraction ----------
-RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import urllib.request, tarfile, os, shutil, re, subprocess
-
-# Scrape 7-zip.org for latest Linux x64 binary
-url = 'https://7-zip.org/download.html'
-req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
-r = urllib.request.urlopen(req, timeout=15)
-html = r.read().decode()
-
-links = re.findall(r'href="(a/7z[\d]+-linux-x64\.tar\.xz)"', html)
-if not links:
-    raise RuntimeError("Could not find 7z download link")
-
-dl_url = f'https://7-zip.org/{links[0]}'
-print(f'Downloading 7z from {dl_url}...')
-req = urllib.request.Request(dl_url, headers={'User-Agent': 'Mozilla/5.0'})
-r = urllib.request.urlopen(req, timeout=30)
-data = r.read()
-
-with open('/tmp/7z.tar.xz', 'wb') as f:
-    f.write(data)
-
-subprocess.run(['tar', '-xJf', '/tmp/7z.tar.xz', '-C', '/tmp/'], check=True)
-
-for root, dirs, files in os.walk('/tmp'):
-    for f in files:
-        if f == '7zz':
-            src = os.path.join(root, f)
-            shutil.move(src, '/usr/local/bin/7zz')
-            os.chmod('/usr/local/bin/7zz', 0o755)
-            print(f'7zz installed from {src}')
-            break
-
-os.remove('/tmp/7z.tar.xz')
-
-# Verify
-r = subprocess.run(['/usr/local/bin/7zz'], capture_output=True, text=True)
-print(f'7-Zip {r.stdout.strip()[:60]}')
-PYEOF
-
 
 # ---------- Runtime ----------
 USER hermes