Merge remote-tracking branch 'origin/fix/network-creation' into HEAD

Merge PR #2 : fix Matrix bridge ModuleNotFoundError - install deps to venv with persistence
- Integrate uv pip install of openai and mautrix[encryption] into entrypoint - Add persistent volume mount for /opt/hermes/.venv - Keep Syncthing volume mounts
2026-05-20 14:29:37 -04:00 · 2026-05-20 14:07:59 -04:00 · 2026-05-20 14:05:45 -04:00 · 2026-04-29 18:42:09 +00:00 · 2026-04-29 03:34:15 +00:00 · 2026-04-29 02:43:35 +00:00
4 changed files with 131 additions and 81 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -32,7 +32,7 @@ services:
        - default
    container_name: hermes
    entrypoint: ["/bin/bash", "-c",
-      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "bash /opt/data/hermes-tools/install.sh && /opt/hermes/.venv/bin/uv pip install openai mautrix[encryption] --system -q && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
      "hermes-entrypoint"]
    restart: always
    # Gateway run enables the internal API server on port 8642
@@ -44,7 +44,7 @@ services:
      - API_SERVER_HOST=0.0.0.0
      - API_SERVER_KEY=hermes_local_key
      - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      - OPENROUTER_API_KEY=${OPEN...KEY}
      # ROCm for GPU-accelerated faster-whisper STT
      - HSA_OVERRIDE_GFX_VERSION=9.0.6
      - HCC_AMDGPU_TARGET=gfx906
@@ -58,6 +58,8 @@ services:
      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
+      # Persistent venv — Matrix bridge and other pip deps survive container rebuilds
+      - /mnt/HoardingCow_docker_data/Hermes/venv:/opt/hermes/.venv
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
@@ -112,7 +114,78 @@ services:
      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
    environment:
      - OLLAMA_VULKAN=0
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0 
      - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_DEBUG=1
+      - OLLAMA_FLASH_ATTENTION=1
+      - OLLAMA_NUM_PARALLEL=2
+    devices:
+      # Map the render nodes and KFD for ROCm to work inside the container
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+
+  paperclip-db:
+    image: postgres:17-alpine
+    container_name: paperclip-db
+    restart: always
+    environment:
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
+    networks:
+      - ai_backend
+
+  paperclip:
+    image: ghcr.io/paperclipai/paperclip:v2026.517.0
+    container_name: paperclip
+    restart: always
+    ports:
+      - "127.0.0.1:3100:3100"
+    environment:
+      - HOST=0.0.0.0
+      - PORT=3100
+      - SERVE_UI=true
+      - DATABASE_URL=postgres://paperclip:***@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPE...CRET must be set}
+      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
+      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
+      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
+    depends_on:
+      paperclip-db:
+        condition: service_healthy
+    networks:
+      - ai_net
+      - ai_backend
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
+      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-http.entrypoints=web"
+      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
+      - "traefik.http.routers.paperclip-https.tls=true"
+      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"

 networks:
  ai_net:
@@ -122,40 +195,47 @@ networks:
    driver: bridge
    name: ai_backend
    
-  llama-cpp-hermes:
-    image: llama-cpp:rocm-gfx906
-    container_name: llama-cpp-hermes
-    restart: unless-stopped
-    networks:
-      - ai_backend
-    ports:
-      - "127.0.0.1:8300:8080"
-    ipc: host
-    devices:
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-    environment:
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HSA_ENABLE_SDMA=0
-      - HIP_VISIBLE_DEVICES=0,1
-      - LLAMA_CACHE=/models
-    volumes:
-      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-    command: >
-      -m /model.gguf
-      --host 0.0.0.0
-      --port 8080
-      --gpu-layers 99
-      --ctx-size 163840
-      -ctk f16 -ctv f16
-      --flash-attn on
-      --split-mode layer
-      --no-mmap
-      --n-predict -1
+  # llama_cpp_devstral:
+  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
+  #   container_name: llama_cpp_devstral
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8080"
+  #   ipc: host
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303" # video
+  #     - "26"  # render
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     LLAMA_CACHE: /models
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
+  #   command: >
+  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
+  #     -a devstral-2-small-llama_cpp
+  #     --chat-template-file /template.jinja
+  #     --host 0.0.0.0
+  #     --port 8080
+  #     --n-gpu-layers 99
+  #     --ctx-size 163840
+  #     --batch-size 4096
+  #     --ubatch-size 4096
+  #     --cache-type-k f16
+  #     --cache-type-v f16
+  #     --cache-reuse 256
+  #     --flash-attn on
+  #     --context-shift
+  #     --split-mode layer
+  #     --no-mmap
+  #     --n-predict -1
+  #     --parallel 2

  # vllm:
  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
@@ -258,8 +338,8 @@ networks:
  #     - /home/gortium/infra:/data/workspace/infra
  #   environment:
  #     - TZ=America/Toronto
-  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPEN...KEN}
+  #     - OPENROUTER_API_KEY=${OPEN...KEY}
  #     # Point to the sidecar browser
  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
  #     - BROWSER_EVALUATE_ENABLED=true
@@ -304,7 +384,7 @@ networks:
  #     - PGID=1000
  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
  #     - SUDO_ACCESS=false
-  #     - PASSWORD_ACCESS=false
+  #     - PASSWORD_ACCESS=***
  #   volumes:
  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
  #     - /home/gortium/infra:/data/workspace/infra:ro
--- a/ai/llama-cpp/Dockerfile
+++ b/ai/llama-cpp/Dockerfile
@@ -1,30 +0,0 @@
-# llama-cpp-rocm6/Dockerfile
-# Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
-# Build: docker build -t llama-cpp:rocm-gfx906 .
-
-FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
-ARG LLAMACPP_VERSION=b9596
-RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
-WORKDIR /build
-ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm
-RUN mkdir build && cd build && \
-    cmake .. -DGGML_HIP=ON -DCMAKE_BUILD_TYPE=Release \
-      -DAMDGPU_TARGETS="gfx906:xnack-" \
-      -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-      -DGGML_CUDA=OFF -DGGML_VULKAN=OFF -DGGML_METAL=OFF \
-      -DBUILD_SHARED_LIBS=OFF && \
-    cmake --build . --target llama-server -- -j $(nproc)
-
-FROM ubuntu:24.04
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    ca-certificates curl libstdc++6 libgomp1 libopenblas0 \
-    libnuma1 libelf1 libdrm2 libdrm-amdgpu1 \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
-COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
-COPY --from=builder /build/build/bin/llama-server /usr/local/bin/llama-server
-RUN echo /opt/rocm/lib > /etc/ld.so.conf.d/rocm.conf && ldconfig
-ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 HCC_AMDGPU_TARGET=gfx906 HSA_ENABLE_SDMA=0
-EXPOSE 8080
-ENTRYPOINT ["/usr/local/bin/llama-server"]
--- a/backup/compose.yml
+++ b/backup/compose.yml
@@ -96,5 +96,5 @@ services:

 networks:
  backup_net:
-    external: true
+    driver: bridge
    name: backup_net
--- a/network/compose.yml
+++ b/network/compose.yml
@@ -82,37 +82,37 @@ networks:
    driver: bridge
    name: traefik_backend
  ai_net:
-    external: true
+    driver: bridge
    name: ai_net
  auth_net:
-    external: true
+    driver: bridge
    name: auth_net
  backup_net:
-    external: true
+    driver: bridge
    name: backup_net
  cloud_net:
-    external: true
+    driver: bridge
    name: cloud_net
  coms_net:
-    external: true
+    driver: bridge
    name: coms_net
  finance_net:
-    external: true
+    driver: bridge
    name: finance_net
  home_auto_net:
-    external: true
+    driver: bridge
    name: home_auto_net
  homepage_net:
-    external: true
+    driver: bridge
    name: homepage_net
  passman_net:
-    external: true
+    driver: bridge
    name: passman_net
  tak_net:
-    external: true
+    driver: bridge
    name: tak_net
  vc_net:
-    external: true
+    driver: bridge
    name: vc_net

  # duckdns:
Author	SHA1	Message	Date
Hermes	c9aacc5125	Merge remote-tracking branch 'origin/fix/network-creation' into HEAD	2026-05-20 14:29:37 -04:00
Hermes	8f09b43a5a	Merge PR #2 : fix Matrix bridge ModuleNotFoundError - install deps to venv with persistence - Integrate uv pip install of openai and mautrix[encryption] into entrypoint - Add persistent volume mount for /opt/hermes/.venv - Keep Syncthing volume mounts	2026-05-20 14:07:59 -04:00
Hermes	64acf2c859	Merge feat/add-paperclip into master: add Paperclip agent orchestrator services Brings in commits: `563ccc5` (paperclip), `37bf43c` (Dockerfile), `bce4032` (revert), `1eacc3c` (Traefik ai_net fix)	2026-05-20 14:05:45 -04:00
Thierry Pouplier	28a172e828	fix: create networks as bridge instead of external - Changed all networks from external: true to driver: bridge - Fixes chicken-and-egg problem where networks must exist before stacks can start - backup_net, ai_net, auth_net, cloud_net, coms_net, finance_net, home_auto_net, homepage_net, passman_net, tak_net, vc_net now created automatically	2026-04-29 18:42:09 +00:00
Thierry Pouplier	2aab06cc1a	fix: use mautrix[encryption] instead of matrix-nio for Matrix bridge The Hermes Matrix gateway uses the mautrix SDK, not matrix-nio. This fixes E2EE support by installing the correct library. Refs: PR #2	2026-04-29 03:34:15 +00:00
Thierry Pouplier	a404f5e2c4	fix: Correct OPENROUTER_API_KEY variable name	2026-04-29 02:43:35 +00:00
Thierry Pouplier	f9afd79f3e	fix: Add openai and matrix-nio dependencies for Hermes Matrix bridge	2026-04-29 02:19:24 +00:00