Merge pull request 'fix: add iptables-nft to wg-easy for nftables-only kernels' (#24) from fix/wg-easy-iptables-nft into master

Reviewed-on: #24

.gitea/workflows/build-hermes.yml

@@ -0,0 +1,31 @@
+name: Build Hermes agent
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'ai/hermes/**'
+      - 'ai/compose.yml'
+  push:
+    branches: [ master ]
+    paths:
+      - 'ai/hermes/**'
+      - 'ai/compose.yml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          git clone -b "${{ github.head_ref || github.ref_name }}" \
+            https://gitea:${{ secrets.GITHUB_TOKEN }}@code.lazyworkhorse.net/gortium/compose.git .
+          git log --oneline -3
+
+      - name: Build hermes image
+        run: |
+          cd ai
+          docker compose build hermes 2>&1
+
+      - name: Verify image
+        run: |
+          docker run --rm ai-hermes /opt/hermes/.venv/bin/python --version 2>&1

.gitea/workflows/build-ollama.yml

@@ -0,0 +1,31 @@
+name: Build ollama (gfx906)
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'ai/ollama/**'
+      - 'ai/compose.yml'
+  push:
+    branches: [ master ]
+    paths:
+      - 'ai/ollama/**'
+      - 'ai/compose.yml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          git clone -b "${{ github.head_ref || github.ref_name }}" \
+            https://gitea:${{ secrets.GITHUB_TOKEN }}@code.lazyworkhorse.net/gortium/compose.git .
+          git log --oneline -3
+
+      - name: Build ollama image
+        run: |
+          cd ai
+          docker compose build ollama --no-cache 2>&1
+
+      - name: Verify version
+        run: |
+          docker run --rm ollama/ollama:rocm-gfx906 ollama --version 2>&1

ai/compose.yml

@@ -31,6 +31,9 @@ services:
       ssh:
         - default
     container_name: hermes
+    entrypoint: ["/bin/bash", "-c",
+      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
     command: gateway run

ai/hermes/Dockerfile

@@ -68,7 +68,8 @@ ENV PATH="/opt/data/.local/bin:${PATH}"
 # Point browser tool to Playwright's Chromium (already in base image)
 ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
 
-VOLUME [ "/opt/data" ]
+# Ensure tools directory and toolsets.py are writable by the hermes runtime user
+# so custom tools can be injected from the persistent volume at startup.
+RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
 
-COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
-ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]
+VOLUME [ "/opt/data" ]

ai/hermes/fix-permissions.sh

@@ -1,38 +0,0 @@
-#!/bin/bash
-# Startup permission fix + TTS patch.
-# Runs as root before the entrypoint drops to the hermes user.
-set -e
-
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
-
-# Fix ownership on critical writable directories
-chown -R hermes:hermes \
-  "$HERMES_HOME/sessions" \
-  "$HERMES_HOME/checkpoints" \
-  "$HERMES_HOME/skills" \
-  "$HERMES_HOME/memories" \
-  "$HERMES_HOME/workspace" \
-  "$HERMES_HOME/pastes" \
-  "$HERMES_HOME/logs" \
-  "$HERMES_HOME/cron" \
-  "$HERMES_HOME/plans" \
-  "$HERMES_HOME/hooks" \
-  "$HERMES_HOME/cache" \
-  2>/dev/null || true
-
-# Fix data volume root ownership
-if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
-  chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
-fi
-
-# ---------- Patch tts_tool.py: replace Edge TTS with Piper ----------
-# Fallback runtime patch in case the volume's site-packages differ from the image.
-# Idempotent: if already patched, the script does nothing.
-PATCH_SCRIPT="/opt/hermes/patch_tts_tool.py"
-if [ -f "$PATCH_SCRIPT" ]; then
-  echo "Applying TTS patch (Piper only, no Edge fallback)..."
-  /opt/hermes/.venv/bin/python3 "$PATCH_SCRIPT" 2>&1 || true
-fi
-
-# Chain to the official Hermes entrypoint
-exec /opt/hermes/docker/entrypoint.sh "$@"

versioncontrol/compose.yml

@@ -7,6 +7,8 @@ services:
       - USER_UID=1000
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
+      - GITEA__actions__ENABLED=true
+      - GITEA__actions__DEFAULT_ACTIONS_URL=off
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
       # Enable Gitea Actions (act_runner required on host)
@@ -44,6 +46,22 @@ services:
       # Internal Routing
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
+  act_runner:
+    image: gitea/act_runner:latest
+    container_name: act_runner
+    environment:
+      - GITEA_INSTANCE_URL=https://code.lazyworkhorse.net
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
+      - GITEA_RUNNER_NAME=ai-host-runner
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://catthehacker/ubuntu:full-22.04,nixos-builder:docker://nixos/nix
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - vc_net
+    restart: always
+    depends_on:
+      - gitea
+
 networks:
   vc_net:
     external: true

vpn/Dockerfile

@@ -0,0 +1,16 @@
+# Custom wg-easy with iptables-nft (nftables-backed iptables)
+# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
+FROM weejewel/wg-easy:latest
+
+# Alpine's iptables-nft provides iptables that uses nftables kernel API
+# instead of the legacy iptable_nat module. This works on kernels
+# where only nftables netfilter modules are available.
+RUN apk add --no-cache iptables-nft
+
+# Ensure iptables-nft takes priority over legacy iptables
+RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
+    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
+    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
+    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
+    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
+    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore

vpn/compose.yml

@@ -2,7 +2,10 @@ version: "3.8"
 
 services:
   wireguard:
-    image: weejewel/wg-easy:latest
+    build:
+      context: ./vpn
+      dockerfile: Dockerfile
+    image: wg-easy-iptables-nft:latest
     container_name: wireguard
     cap_add:
       - NET_ADMIN