feat: add custom Dockerfile with Hermes adapter baked in

Creates ai/paperclip/ with:
- Dockerfile: extends upstream paperclip image, pre-installs
  hermes-paperclip-adapter@0.3.0 npm package as seed data
- docker-entrypoint.sh: seeds the adapter plugin on first boot
  if the persistent volume is empty, then runs original startup

This ensures the Hermes adapter is available on first boot without
requiring network access — no npm install needed at runtime. The
adapter persists on the Docker volume across restarts.

AGENTS.md

@@ -1,31 +0,0 @@
-# AGENTS.md
-
-Development conventions for the compose repository (Docker Compose stacks).
-
-## Build & Deploy
-
-- The ai stack is managed via `systemctl restart ai_stack.service` on the NixOS host
-- Compose files are built from the git repo; apply via `nh os switch` or `systemctl restart ai_stack.service`
-- Never `docker compose up -d` directly — it bypasses the systemd env file and breaks secrets
-
-## Hermes Workers
-
-- Paperclip Hermes workers are added via `ai/scripts/provision-hermes-worker.sh`
-- The script appends only — never deletes or modifies existing content
-- Workers are CPU-only containers on the `ai_backend` network with no GPU passthrough
-
-## Workflow
-
-- New feature → clean branch from `origin/master` → push → PR on Gitea
-- Branch naming: `feat/description` (features), `fix/description` (bugs/docs)
-- Always branch from `origin/master`, never from another feature branch
-- Submodule changes (when this repo is consumed as a submodule): commit the submodule update in the parent repo
-- PR title should describe the change; body should explain motivation + summary
-- After PR merge, delete the feature branch
-
-## YAML Conventions
-
-- Use `x-*` extension fields for reusable anchors
-- Comment out inactive services rather than deleting them
-- Environment variables in dictionary format (`KEY: value`) for anchor compatibility
-- List format (`- KEY=value`) works for standard services but doesn't merge with anchors

ai/compose.yml

@@ -1,35 +1,4 @@
 version: "3.8"
-
-# ── Hermes Worker Template ──────────────────────────────────
-# Used by paperclip-worker-* Hermes containers via YAML anchor.
-# Each worker = one isolated Hermes agent for a Paperclip employee.
-# Override at service level: container_name, API_SERVER_PORT,
-# API_SERVER_KEY, DISCORD_BOT_TOKEN, volumes.
-# Workers have NO GPU — they use OpenCode Go or remote providers.
-x-hermes-worker: &hermes-worker
-  build:
-    context: ./hermes
-    ssh:
-      - default
-  entrypoint: ["/bin/bash", "-c",
-    "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
-    "hermes-entrypoint"]
-  command: gateway run
-  restart: always
-  environment:
-    API_SERVER_ENABLED: "true"
-    API_SERVER_HOST: "0.0.0.0"
-    OLLAMA_HOST: "http://ollama:11434"
-    OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-    # Each worker needs its own OpenCode Go API key in .env
-    OPENCODE_GO_API_KEY: ${OPENCODE_GO_API_KEY}
-    GATEWAY_ALLOW_ALL_USERS: "true"
-    TZ: "America/Montreal"
-  networks:
-    ai_backend:
-  # NO devices — workers are CPU-only, no GPU passthrough
-# ─────────────────────────────────────────────────────────────
-
 services:
 
   # webui:
@@ -127,23 +96,61 @@ services:
       - "303"
       - "26"
 
-# ── Paperclip Worker Hermes Agents ──────────────────────────
-# Each worker is an isolated Hermes agent for a Paperclip employee.
-# Add new workers with: ./scripts/provision-hermes-worker.sh <name> <discord-token>
-# The API server key and port are generated automatically.
-# Workers are CPU-only — they use OpenCode Go or remote providers.
+  paperclip-db:
+    image: postgres:17-alpine
+    container_name: paperclip-db
+    restart: always
+    environment:
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
+    networks:
+      - ai_backend
 
-  # ── Worker Template (commented — uncomment + configure to activate) ──
-  # hermes-worker-1:
-  #   <<: *hermes-worker
-  #   container_name: hermes-worker-1
-  #   environment:
-  #     API_SERVER_PORT: "8651"
-  #     API_SERVER_KEY: "generated-by-provision-script"
-  #     DISCORD_BOT_TOKEN: ${WORKER_1_DISCORD_BOT_TOKEN}
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Hermes/worker-1:/opt/data
-# ─────────────────────────────────────────────────────────────
+  paperclip:
+    build:
+      context: ./paperclip
+    container_name: paperclip
+    restart: always
+    ports:
+      - "127.0.0.1:3100:3100"
+    environment:
+      - HOST=0.0.0.0
+      - PORT=3100
+      - SERVE_UI=true
+      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
+      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
+      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
+      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
+    depends_on:
+      paperclip-db:
+        condition: service_healthy
+    networks:
+      - ai_net
+      - ai_backend
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-http.entrypoints=web"
+      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
+      - "traefik.http.routers.paperclip-https.tls=true"
+      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
 
 networks:
   ai_net:

ai/paperclip/Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.20
+FROM ghcr.io/paperclipai/paperclip:v2026.517.0
+
+# ── Install Hermes adapter npm package into seed directory ──────────
+# This seed data gets copied to the persistent volume on first boot
+# so the adapter is available without network access.
+USER root
+
+RUN npm install --no-save --prefix /opt/paperclip-seed/adapter-plugins \
+    hermes-paperclip-adapter@0.3.0
+
+# Create adapter-plugins.json metadata (Paperclip reads this on startup
+# to discover which external adapters to load)
+RUN mkdir -p /opt/paperclip-seed && python3 -c "
+import json
+record = {
+    'packageName': 'hermes-paperclip-adapter',
+    'version': '0.3.0',
+    'type': 'hermes',
+    'installedAt': '2026-05-18T00:00:00.000Z',
+}
+with open('/opt/paperclip-seed/adapter-plugins.json', 'w') as f:
+    json.dump([record], f, indent=2)
+"
+
+# Ensure the adapter-plugins dir has a package.json (Paperclip expects one)
+RUN python3 -c "
+import json
+pkg = {
+    'name': 'paperclip-adapter-plugins',
+    'version': '0.0.0',
+    'private': True,
+    'description': 'Managed directory for Paperclip external adapter plugins.',
+}
+with open('/opt/paperclip-seed/adapter-plugins/package.json', 'w') as f:
+    json.dump(pkg, f, indent=2)
+"
+
+# ── Custom entrypoint ──────────────────────────────────────────────
+# Seeds the Hermes adapter on fresh volumes, then runs original logic.
+COPY docker-entrypoint.sh /usr/local/bin/paperclip-entrypoint.sh
+RUN chmod +x /usr/local/bin/paperclip-entrypoint.sh
+
+USER node
+
+ENTRYPOINT ["/usr/local/bin/paperclip-entrypoint.sh"]
+CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]

ai/paperclip/docker-entrypoint.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+# ── Seed Hermes adapter if volume is fresh ──────────────────────────
+PAPERCLIP_HOME="${PAPERCLIP_HOME:-/paperclip}"
+if [ ! -f "${PAPERCLIP_HOME}/adapter-plugins.json" ]; then
+    echo "[paperclip] Seeding Hermes adapter plugin..."
+    cp -r /opt/paperclip-seed/* "${PAPERCLIP_HOME}/"
+    chown -R "${USER_UID:-1000}:${USER_GID:-1000}" \
+        "${PAPERCLIP_HOME}/adapter-plugins" \
+        "${PAPERCLIP_HOME}/adapter-plugins.json"
+    echo "[paperclip] Hermes adapter seeded. Ready to create Hermes agents."
+fi
+
+# ── Original entrypoint logic (UID/GID adjustment) ──────────────────
+PUID="${USER_UID:-1000}"
+PGID="${USER_GID:-1000}"
+changed=0
+
+if [ "$(id -u node)" -ne "$PUID" ]; then
+    usermod -o -u "$PUID" node
+    changed=1
+fi
+
+if [ "$(id -g node)" -ne "$PGID" ]; then
+    groupmod -o -g "$PGID" node
+    usermod -g "$PGID" node
+    changed=1
+fi
+
+if [ "$changed" = "1" ]; then
+    chown -R node:node "${PAPERCLIP_HOME}"
+fi
+
+exec gosu node "$@"

ai/scripts/provision-hermes-worker.sh

@@ -1,135 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# ── Hermes Worker Provisioner ──────────────────────────────
-# Adds a new Paperclip Hermes worker to the ai compose stack.
-#
-# Usage:
-#   ./provision-hermes-worker.sh <name> <discord_bot_token_var>
-#
-# Example:
-#   ./provision-hermes-worker.sh worker-1 WORKER_1_DISCORD_BOT_TOKEN
-#
-# The script APPENDS only — never modifies or removes existing
-# content, even commented lines.
-#
-# Post-provision steps (manual):
-#   1. Add secrets to agenix .env file
-#   2. systemctl restart ai_stack.service
-#   3. Configure Paperclip agent
-# ─────────────────────────────────────────────────────────────
-
-NAME="${1:?Usage: $0 <name> <discord_bot_token_var>}"
-TOKEN_VAR="${2:?Usage: $0 <name> <discord_bot_token_var>}"
-
-# ── Paths ───────────────────────────────────────────────────
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-COMPOSE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-COMPOSE_FILE="${COMPOSE_DIR}/compose.yml"
-
-# Each Hermes worker gets its own volume on the NFS HoardingCow
-VOLUME_BASE="/mnt/HoardingCow_docker_data/Hermes"
-VOLUME_DIR="${VOLUME_BASE}/${NAME}"
-
-# The Hermes container runs as UID 10000 (hermes user from Dockerfile)
-HERMES_UID=10000
-
-# ── Validation ──────────────────────────────────────────────
-if ! [ -f "$COMPOSE_FILE" ]; then
-  echo "❌ compose.yml not found at $COMPOSE_FILE"
-  exit 1
-fi
-
-if grep -q "^  ${NAME}:" "$COMPOSE_FILE"; then
-  echo "❌ Service '${NAME}' already exists in ${COMPOSE_FILE}"
-  exit 1
-fi
-
-# ── Generate unique API key ─────────────────────────────────
-# Used by Paperclip to authenticate against this worker's
-# Hermes API server (/v1/chat/completions)
-API_KEY="pc_worker_$(openssl rand -hex 16)"
-
-# ── Find next available API port ────────────────────────────
-# Workers get sequential ports starting at 8650.
-# Scans compose.yml for existing API_SERVER_PORT values and
-# picks the next one.
-BASE_PORT=8650
-MAX_PORT=0
-while IFS= read -r line; do
-  port="${line#*API_SERVER_PORT: \"}"
-  port="${port%%\"*}"
-  if [ -n "$port" ] && [ "$port" -gt "$MAX_PORT" ]; then
-    MAX_PORT="$port"
-  fi
-done < <(grep -oP 'API_SERVER_PORT:\s*"\d+"' "$COMPOSE_FILE" 2>/dev/null)
-
-NEW_PORT=$((MAX_PORT + 1))
-if [ "$NEW_PORT" -lt "$BASE_PORT" ]; then
-  NEW_PORT=$BASE_PORT
-fi
-
-# ── Create volume directory (on NFS) ────────────────────────
-echo "📁 Creating volume directory: ${VOLUME_DIR}"
-mkdir -p "$VOLUME_DIR"
-
-# Hermes container runs as UID 10000 — set ownership so the
-# container can write its config, sessions, skills
-if command -v chown &>/dev/null; then
-  chown -R "${HERMES_UID}:${HERMES_UID}" "$VOLUME_DIR" 2>/dev/null || \
-    echo "⚠ Could not chown ${VOLUME_DIR} — run with sudo if needed"
-fi
-
-# Make it group-readable for debugging
-chmod 755 "$VOLUME_DIR" 2>/dev/null || true
-
-# ── Append service to compose.yml ───────────────────────────
-echo "📝 Appending service '${NAME}' to compose.yml ..."
-
-TMPFILE=$(mktemp)
-
-awk -v name="$NAME" \
-    -v port="$NEW_PORT" \
-    -v api_key="$API_KEY" \
-    -v token_var="$TOKEN_VAR" \
-    '
-    # Insert new worker service block just before the networks: section
-    /^networks:/ {
-      print ""
-      print "  " name ":"
-      print "    <<: *hermes-worker"
-      print "    container_name: " name
-      print "    environment:"
-      print "      API_SERVER_PORT: \"" port "\""
-      print "      API_SERVER_KEY: \"" api_key "\""
-      print "      DISCORD_BOT_TOKEN: ${" token_var "}"
-      print "    volumes:"
-      print "      - /mnt/HoardingCow_docker_data/Hermes/" name ":/opt/data"
-      print ""
-    }
-    { print }
-' "$COMPOSE_FILE" > "$TMPFILE" && mv "$TMPFILE" "$COMPOSE_FILE"
-
-# ── Done ────────────────────────────────────────────────────
-echo ""
-echo "✅ Worker '${NAME}' provisioned successfully"
-echo ""
-echo "────────────────────────────────────────────"
-echo "  NEXT STEPS"
-echo "────────────────────────────────────────────"
-echo ""
-echo "1. Add secrets to the agenix .env stack file:"
-echo ""
-echo "   # ${NAME}"
-echo "   ${TOKEN_VAR}=<paste-discord-bot-token-here>"
-echo ""
-echo "2. Restart the AI stack:"
-echo ""
-echo "   systemctl restart ai_stack.service"
-echo ""
-echo "3. In Paperclip, create an agent with HTTP adapter:"
-echo ""
-echo "   Endpoint: http://${NAME}:${NEW_PORT}/v1/chat/completions"
-echo "   API Key:  ${API_KEY}"
-echo ""
-echo "────────────────────────────────────────────"

versioncontrol/compose.yml

@@ -8,13 +8,10 @@ services:
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
       - GITEA__actions__ENABLED=true
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
       # Enable Gitea Actions (act_runner required on host)
       - GITEA__actions__ENABLED=true
-      # Don't fetch actions from GitHub (offline mode + local only)
-      - GITEA__actions__DEFAULT_ACTIONS_URL=off
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks: