Compare commits
28 Commits
feat/honch
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
| 3d90f57e7f | |||
| c1cd9d31e9 | |||
| 5765dc6004 | |||
| e8075fb71b | |||
| 645d519030 | |||
| 146add2a64 | |||
| eb3795d9e3 | |||
| ef6e0e57b6 | |||
| d8a1ebcd96 | |||
| 45a224eb7f | |||
| 46f3b23a3f | |||
| 567850bd13 | |||
| bce336c4fd | |||
| e4117cd3d5 | |||
| 2d59bb44c3 | |||
| bf56d4be8b | |||
| 1c8efb1090 | |||
| 7725830e6c | |||
| 548e15d6b4 | |||
| 35aa466e87 | |||
| 2ff99b1f57 | |||
| dea1429a5d | |||
| ebad994d60 | |||
| 5f25c87775 | |||
| 4e566b2408 | |||
|
|
2aab06cc1a | ||
|
|
a404f5e2c4 | ||
|
|
f9afd79f3e |
183
ai/compose.yml
Normal file → Executable file
183
ai/compose.yml
Normal file → Executable file
@@ -32,19 +32,24 @@ services:
|
|||||||
- default
|
- default
|
||||||
container_name: hermes
|
container_name: hermes
|
||||||
entrypoint: ["/bin/bash", "-c",
|
entrypoint: ["/bin/bash", "-c",
|
||||||
"bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
|
"bash /opt/data/hermes-tools/install.sh && bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
|
||||||
"hermes-entrypoint"]
|
"hermes-entrypoint"]
|
||||||
restart: always
|
restart: always
|
||||||
# Gateway run enables the internal API server on port 8642
|
# Gateway run enables the internal API server on port 8642
|
||||||
command: gateway run
|
command: gateway run
|
||||||
environment:
|
environment:
|
||||||
- OLLAMA_HOST=http://ollama:11434
|
- OLLAMA_HOST=http://ollama:11434
|
||||||
|
- HERMES_DASHBOARD=1
|
||||||
|
# Multi-profile: comma-separated list of profiles to run as gateways.
|
||||||
|
# The entrypoint reads this and starts one gateway per profile.
|
||||||
|
# Add profiles here when they exist on disk (e.g. default,researcher,writer)
|
||||||
|
- HERMES_PROFILES=ashley,claire,finn,matt,paul
|
||||||
- API_SERVER_ENABLED=true
|
- API_SERVER_ENABLED=true
|
||||||
- API_SERVER_PORT=8642
|
- API_SERVER_PORT=8642
|
||||||
- API_SERVER_HOST=0.0.0.0
|
- API_SERVER_HOST=0.0.0.0
|
||||||
- API_SERVER_KEY=hermes_local_key
|
- API_SERVER_KEY=hermes_local_key
|
||||||
- GATEWAY_ALLOW_ALL_USERS=true
|
- GATEWAY_ALLOW_ALL_USERS=true
|
||||||
- OPENROUTER_API_KEY=${OPEN...KEY}
|
- OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
|
||||||
# ROCm for GPU-accelerated faster-whisper STT
|
# ROCm for GPU-accelerated faster-whisper STT
|
||||||
- HSA_OVERRIDE_GFX_VERSION=9.0.6
|
- HSA_OVERRIDE_GFX_VERSION=9.0.6
|
||||||
- HCC_AMDGPU_TARGET=gfx906
|
- HCC_AMDGPU_TARGET=gfx906
|
||||||
@@ -66,6 +71,30 @@ services:
|
|||||||
- "26"
|
- "26"
|
||||||
networks:
|
networks:
|
||||||
- ai_backend
|
- ai_backend
|
||||||
|
- ai_net
|
||||||
|
labels:
|
||||||
|
- "traefik.enable=true"
|
||||||
|
- "traefik.docker.network=ai_net"
|
||||||
|
|
||||||
|
# Router for HTTP + redirection to HTTPS
|
||||||
|
- "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
|
||||||
|
- "traefik.http.routers.hermes-web-http.entrypoints=web"
|
||||||
|
- "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
|
||||||
|
|
||||||
|
# Router for HTTPS with TLS — protected by Authelia
|
||||||
|
- "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
|
||||||
|
- "traefik.http.routers.hermes-web-https.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.hermes-web-https.tls=true"
|
||||||
|
- "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
|
||||||
|
- "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
|
||||||
|
|
||||||
|
# Authelia forwardAuth
|
||||||
|
- "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
|
||||||
|
- "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
|
||||||
|
- "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
|
||||||
|
|
||||||
|
# Service Loadbalancer (dashboard port 9119)
|
||||||
|
- "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
|
||||||
|
|
||||||
syncthing:
|
syncthing:
|
||||||
image: syncthing/syncthing:latest
|
image: syncthing/syncthing:latest
|
||||||
@@ -129,150 +158,6 @@ services:
|
|||||||
- "303"
|
- "303"
|
||||||
- "26"
|
- "26"
|
||||||
|
|
||||||
paperclip-db:
|
|
||||||
image: postgres:17-alpine
|
|
||||||
container_name: paperclip-db
|
|
||||||
restart: always
|
|
||||||
environment:
|
|
||||||
POSTGRES_USER: paperclip
|
|
||||||
POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
|
|
||||||
POSTGRES_DB: paperclip
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
|
|
||||||
interval: 5s
|
|
||||||
timeout: 5s
|
|
||||||
retries: 10
|
|
||||||
volumes:
|
|
||||||
- /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
|
|
||||||
networks:
|
|
||||||
- ai_backend
|
|
||||||
|
|
||||||
paperclip:
|
|
||||||
image: ghcr.io/paperclipai/paperclip:v2026.517.0
|
|
||||||
container_name: paperclip
|
|
||||||
restart: always
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:3100:3100"
|
|
||||||
environment:
|
|
||||||
- HOST=0.0.0.0
|
|
||||||
- PORT=3100
|
|
||||||
- SERVE_UI=true
|
|
||||||
- DATABASE_URL=postgres://paperclip:***@paperclip-db:5432/paperclip
|
|
||||||
- BETTER_AUTH_SECRET=${PAPE...CRET must be set}
|
|
||||||
- PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
|
|
||||||
- PAPERCLIP_DEPLOYMENT_MODE=authenticated
|
|
||||||
- PAPERCLIP_DEPLOYMENT_EXPOSURE=private
|
|
||||||
volumes:
|
|
||||||
- /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
|
|
||||||
depends_on:
|
|
||||||
paperclip-db:
|
|
||||||
condition: service_healthy
|
|
||||||
networks:
|
|
||||||
- ai_net
|
|
||||||
- ai_backend
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.docker.network=ai_net"
|
|
||||||
|
|
||||||
- "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
|
|
||||||
- "traefik.http.routers.paperclip-http.entrypoints=web"
|
|
||||||
- "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
|
|
||||||
|
|
||||||
- "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
|
|
||||||
- "traefik.http.routers.paperclip-https.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.paperclip-https.tls=true"
|
|
||||||
- "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
|
|
||||||
|
|
||||||
- "traefik.http.services.paperclip.loadbalancer.server.port=3100"
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Honcho — Memory infrastructure for stateful AI agents
|
|
||||||
# Self-hosted memory server with pgvector for embedding storage.
|
|
||||||
# Defaults to Ollama for embeddings; configure LLM provider for full deriver
|
|
||||||
# and summarization support.
|
|
||||||
#
|
|
||||||
# API port: 8000
|
|
||||||
# Web: https://honcho.lazyworkhorse.net
|
|
||||||
# Docs: https://github.com/plastic-labs/honcho
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
honcho-db:
|
|
||||||
image: pgvector/pgvector:pg17-trixie
|
|
||||||
container_name: honcho-db
|
|
||||||
restart: unless-stopped
|
|
||||||
environment:
|
|
||||||
POSTGRES_DB: honcho
|
|
||||||
POSTGRES_USER: honcho
|
|
||||||
POSTGRES_PASSWORD: ${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set}
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
|
|
||||||
interval: 5s
|
|
||||||
timeout: 5s
|
|
||||||
retries: 10
|
|
||||||
volumes:
|
|
||||||
- /mnt/HoardingCow_docker_data/Honcho/pgdata:/var/lib/postgresql/data
|
|
||||||
- ./honcho/init.sql:/docker-entrypoint-initdb.d/init.sql
|
|
||||||
networks:
|
|
||||||
- ai_backend
|
|
||||||
|
|
||||||
honcho:
|
|
||||||
build:
|
|
||||||
context: ./honcho
|
|
||||||
dockerfile: Dockerfile
|
|
||||||
container_name: honcho
|
|
||||||
restart: unless-stopped
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:8000:8000"
|
|
||||||
depends_on:
|
|
||||||
honcho-db:
|
|
||||||
condition: service_healthy
|
|
||||||
environment:
|
|
||||||
DB_CONNECTION_URI: postgresql+psycopg://honcho:${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set}@honcho-db:5432/honcho
|
|
||||||
LOG_LEVEL: INFO
|
|
||||||
LLM_OPENAI_API_KEY: ${LLM_OPENAI_API_KEY:-ollama}
|
|
||||||
volumes:
|
|
||||||
- /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml
|
|
||||||
networks:
|
|
||||||
- ai_backend
|
|
||||||
- ai_net
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.docker.network=ai_net"
|
|
||||||
|
|
||||||
- "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
|
|
||||||
- "traefik.http.routers.honcho-http.entrypoints=web"
|
|
||||||
- "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
|
|
||||||
|
|
||||||
- "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
|
|
||||||
- "traefik.http.routers.honcho-https.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.honcho-https.tls=true"
|
|
||||||
- "traefik.http.routers.honcho-https.tls.certresolver=njalla"
|
|
||||||
|
|
||||||
- "traefik.http.services.honcho.loadbalancer.server.port=8000"
|
|
||||||
|
|
||||||
holographic-memory:
|
|
||||||
build:
|
|
||||||
context: ./holographic-memory
|
|
||||||
image: holographic-memory:latest
|
|
||||||
container_name: holographic-memory
|
|
||||||
restart: unless-stopped
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:8100:8100"
|
|
||||||
environment:
|
|
||||||
- HOLOGRAPHIC_DB_PATH=/data/holographic/memory_store.db
|
|
||||||
- HOLOGRAPHIC_PORT=8100
|
|
||||||
- HOLOGRAPHIC_DEFAULT_TRUST=0.5
|
|
||||||
volumes:
|
|
||||||
- /mnt/HoardingCow_docker_data/HolographicMemory:/data/holographic
|
|
||||||
networks:
|
|
||||||
- ai_backend
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8100/health')"]
|
|
||||||
interval: 30s
|
|
||||||
timeout: 5s
|
|
||||||
retries: 3
|
|
||||||
start_period: 10s
|
|
||||||
|
|
||||||
networks:
|
networks:
|
||||||
ai_net:
|
ai_net:
|
||||||
external: true
|
external: true
|
||||||
@@ -424,8 +309,8 @@ networks:
|
|||||||
# - /home/gortium/infra:/data/workspace/infra
|
# - /home/gortium/infra:/data/workspace/infra
|
||||||
# environment:
|
# environment:
|
||||||
# - TZ=America/Toronto
|
# - TZ=America/Toronto
|
||||||
# - OPENCLAW_GATEWAY_TOKEN=${OPEN...KEN}
|
# - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
|
||||||
# - OPENROUTER_API_KEY=${OPEN...KEY}
|
# - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
|
||||||
# # Point to the sidecar browser
|
# # Point to the sidecar browser
|
||||||
# - BROWSER_CDP_URL=http://openclaw-browser:9222
|
# - BROWSER_CDP_URL=http://openclaw-browser:9222
|
||||||
# - BROWSER_EVALUATE_ENABLED=true
|
# - BROWSER_EVALUATE_ENABLED=true
|
||||||
@@ -470,7 +355,7 @@ networks:
|
|||||||
# - PGID=1000
|
# - PGID=1000
|
||||||
# - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
|
# - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
|
||||||
# - SUDO_ACCESS=false
|
# - SUDO_ACCESS=false
|
||||||
# - PASSWORD_ACCESS=***
|
# - PASSWORD_ACCESS=false
|
||||||
# volumes:
|
# volumes:
|
||||||
# - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
|
# - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
|
||||||
# - /home/gortium/infra:/data/workspace/infra:ro
|
# - /home/gortium/infra:/data/workspace/infra:ro
|
||||||
|
|||||||
@@ -20,16 +20,10 @@ RUN --mount=type=ssh \
|
|||||||
GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
|
GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
|
||||||
git clone --depth 1 --branch main \
|
git clone --depth 1 --branch main \
|
||||||
git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
|
git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
|
||||||
rsync -a --delete fork/ /opt/hermes/ \
|
rm -rf fork/node_modules fork/.venv fork/.git && \
|
||||||
--exclude node_modules \
|
cp -a fork/. /opt/hermes/ && \
|
||||||
--exclude .venv \
|
|
||||||
--exclude .git && \
|
|
||||||
rm -rf /tmp/fork /root/.ssh/
|
rm -rf /tmp/fork /root/.ssh/
|
||||||
|
|
||||||
# ---------- Rebuild web UI ----------
|
|
||||||
# Source files changed; node_modules (from base image) reused.
|
|
||||||
RUN cd /opt/hermes && npm run build
|
|
||||||
|
|
||||||
# ---------- Reinstall Python package (editable) ----------
|
# ---------- Reinstall Python package (editable) ----------
|
||||||
# Picks up source changes from our fork.
|
# Picks up source changes from our fork.
|
||||||
RUN . /opt/hermes/.venv/bin/activate && \
|
RUN . /opt/hermes/.venv/bin/activate && \
|
||||||
@@ -40,6 +34,7 @@ USER root
|
|||||||
RUN apt-get update && \
|
RUN apt-get update && \
|
||||||
apt-get install -y --no-install-recommends \
|
apt-get install -y --no-install-recommends \
|
||||||
libportaudio2 ca-certificates poppler-utils imagemagick \
|
libportaudio2 ca-certificates poppler-utils imagemagick \
|
||||||
|
libolm-dev \
|
||||||
texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
|
texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
|
||||||
texlive-xetex texlive-science \
|
texlive-xetex texlive-science \
|
||||||
qemu-user-static binfmt-support emacs-nox && \
|
qemu-user-static binfmt-support emacs-nox && \
|
||||||
@@ -48,6 +43,12 @@ RUN apt-get update && \
|
|||||||
# ---------- UV ----------
|
# ---------- UV ----------
|
||||||
COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
|
COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
|
||||||
|
|
||||||
|
# ---------- Matrix bridge + extra pip deps ----------
|
||||||
|
# Previously installed inline at container startup and persisted via volume mount.
|
||||||
|
# Now baked into the image so the fragile venv volume mount can be removed.
|
||||||
|
RUN . /opt/hermes/.venv/bin/activate && \
|
||||||
|
uv pip install --no-cache-dir 'mautrix[encryption]' openai
|
||||||
|
|
||||||
# ---------- Piper TTS ----------
|
# ---------- Piper TTS ----------
|
||||||
RUN . /opt/hermes/.venv/bin/activate && \
|
RUN . /opt/hermes/.venv/bin/activate && \
|
||||||
uv pip install --no-cache-dir piper-tts sounddevice numpy && \
|
uv pip install --no-cache-dir piper-tts sounddevice numpy && \
|
||||||
@@ -75,29 +76,9 @@ os.remove(tgz)
|
|||||||
print('himalaya v1.2.0 installed')
|
print('himalaya v1.2.0 installed')
|
||||||
PYEOF
|
PYEOF
|
||||||
|
|
||||||
# ---------- Install himalaya-ro wrapper ----------
|
# ---------- Install multi-gateway launcher ----------
|
||||||
COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
|
# Launches one gateway process per profile (HERMES_PROFILES env var)
|
||||||
|
COPY --chmod=0755 run-multi-gateways.sh /usr/local/bin/run-multi-gateways.sh
|
||||||
|
|
||||||
# ---------- Install 7-Zip (7zz) for CHM extraction ----------
|
|
||||||
RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
|
|
||||||
import urllib.request, tarfile, os, shutil, subprocess
|
|
||||||
url = 'https://github.com/ip7z/7zip/releases/download/26.01/7z2601-linux-x64.tar.xz'
|
|
||||||
xz = '/tmp/7z2601-linux-x64.tar.xz'
|
|
||||||
urllib.request.urlretrieve(url, xz)
|
|
||||||
os.makedirs('/tmp/7z', exist_ok=True)
|
|
||||||
with tarfile.open(xz, 'r:xz') as t:
|
|
||||||
t.extractall('/tmp/7z')
|
|
||||||
shutil.move('/tmp/7z/7zz', '/usr/local/bin/7zz')
|
|
||||||
os.chmod('/usr/local/bin/7zz', 0o755)
|
|
||||||
shutil.rmtree('/tmp/7z', ignore_errors=True)
|
|
||||||
os.remove(xz)
|
|
||||||
# Verify
|
|
||||||
result = subprocess.run(['/usr/local/bin/7zz'], capture_output=True, text=True)
|
|
||||||
assert result.returncode == 0, f'7zz verify failed: {result.stderr}'
|
|
||||||
print('7-Zip 26.01 installed successfully')
|
|
||||||
PYEOF
|
|
||||||
|
|
||||||
|
|
||||||
# ---------- Runtime ----------
|
# ---------- Runtime ----------
|
||||||
USER hermes
|
USER hermes
|
||||||
@@ -108,6 +89,7 @@ ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
|
|||||||
|
|
||||||
# Ensure tools directory and toolsets.py are writable by the hermes runtime user
|
# Ensure tools directory and toolsets.py are writable by the hermes runtime user
|
||||||
# so custom tools can be injected from the persistent volume at startup.
|
# so custom tools can be injected from the persistent volume at startup.
|
||||||
|
USER root
|
||||||
RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
|
RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
|
||||||
|
|
||||||
VOLUME [ "/opt/data" ]
|
VOLUME [ "/opt/data" ]
|
||||||
@@ -1,73 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# ─────────────────────────────────────────────────────────────
|
|
||||||
# himalaya-ro — Read-only wrapper for himalaya
|
|
||||||
#
|
|
||||||
# Blocks destructive commands and logs audit trail.
|
|
||||||
# Pass-through for read-only commands (list, read, search).
|
|
||||||
#
|
|
||||||
# Usage: himalaya-ro [options] <command> [args...]
|
|
||||||
#
|
|
||||||
# Install: place in PATH before the real himalaya, or use
|
|
||||||
# `ln -sf himalaya-ro /usr/local/bin/himalaya`
|
|
||||||
# ─────────────────────────────────────────────────────────────
|
|
||||||
set -o pipefail
|
|
||||||
|
|
||||||
# ── Configuration ───────────────────────────────────────────
|
|
||||||
HIMALAYA_BIN="${HIMALAYA_BIN:-/usr/local/bin/himalaya}"
|
|
||||||
AUDIT_LOG="${HIMALAYA_AUDIT_LOG:-/var/log/himalaya-audit.log}"
|
|
||||||
|
|
||||||
# ── Destructive commands we block ──────────────────────────
|
|
||||||
BLOCKED_CMDS=(
|
|
||||||
"message move"
|
|
||||||
"message delete"
|
|
||||||
"message copy"
|
|
||||||
"flag add"
|
|
||||||
"flag remove"
|
|
||||||
"folder create"
|
|
||||||
"folder delete"
|
|
||||||
"folder rename"
|
|
||||||
"template send"
|
|
||||||
"account configure"
|
|
||||||
"account delete"
|
|
||||||
)
|
|
||||||
|
|
||||||
# ── Determine the subcommand being invoked ─────────────────
|
|
||||||
# Strip leading options (--account, --output, etc.) to find the verb
|
|
||||||
ARGS=()
|
|
||||||
SKIP_NEXT=false
|
|
||||||
for arg in "$@"; do
|
|
||||||
if $SKIP_NEXT; then
|
|
||||||
SKIP_NEXT=false
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
if [[ "$arg" == --* ]]; then
|
|
||||||
case "$arg" in
|
|
||||||
--account|--output|--page|--page-size|--folder|--color|--format)
|
|
||||||
SKIP_NEXT=true ;;
|
|
||||||
esac
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
ARGS+=("$arg")
|
|
||||||
done
|
|
||||||
|
|
||||||
# Build subcommand string and check against blocklist
|
|
||||||
CMD_STR=""
|
|
||||||
for ((i=0; i<${#ARGS[@]}; i++)); do
|
|
||||||
if [ -z "$CMD_STR" ]; then
|
|
||||||
CMD_STR="${ARGS[$i]}"
|
|
||||||
else
|
|
||||||
CMD_STR="$CMD_STR ${ARGS[$i]}"
|
|
||||||
fi
|
|
||||||
for blocked in "${BLOCKED_CMDS[@]}"; do
|
|
||||||
if [[ "$CMD_STR" == "$blocked" ]]; then
|
|
||||||
TS=$(date '+%Y-%m-%d %H:%M:%S')
|
|
||||||
echo "[AUDIT] $TS BLOCKED: himalaya $*" >> "$AUDIT_LOG"
|
|
||||||
echo "ERROR: Command 'himalaya $CMD_STR ...' is blocked by read-only policy." >&2
|
|
||||||
echo " Audit log: $AUDIT_LOG" >&2
|
|
||||||
exit 100
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
done
|
|
||||||
|
|
||||||
# ── Allow pass-through ─────────────────────────────────────
|
|
||||||
exec "$HIMALAYA_BIN" "$@"
|
|
||||||
32
ai/hermes/run-multi-gateways.sh
Executable file
32
ai/hermes/run-multi-gateways.sh
Executable file
@@ -0,0 +1,32 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Multi-gateway launcher for HERMES_PROFILES env var.
|
||||||
|
# Reads comma-separated profile names, spawns one gateway per profile.
|
||||||
|
# Designed to run before the main entrypoint — gateways run in background.
|
||||||
|
set -e
|
||||||
|
|
||||||
|
if [ -z "${HERMES_PROFILES}" ]; then
|
||||||
|
echo "HERMES_PROFILES not set — skipping multi-gateway launch"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Source venv to make 'hermes' available (entrypoint.sh sources it later,
|
||||||
|
# but we need it NOW for the background gateways)
|
||||||
|
HERMES_BIN="/opt/hermes/.venv/bin/hermes"
|
||||||
|
if [ ! -x "$HERMES_BIN" ]; then
|
||||||
|
echo "ERROR: hermes binary not found at $HERMES_BIN"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
mkdir -p /opt/data/logs
|
||||||
|
|
||||||
|
IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
|
||||||
|
for profile in "${PROFILES[@]}"; do
|
||||||
|
profile="$(echo "${profile}" | xargs)" # trim whitespace
|
||||||
|
[ -z "${profile}" ] && continue
|
||||||
|
|
||||||
|
echo "Starting gateway for profile: ${profile}"
|
||||||
|
nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
|
||||||
|
>> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "All gateways launched: ${HERMES_PROFILES}"
|
||||||
@@ -1,72 +0,0 @@
|
|||||||
# Honcho — Memory infrastructure for stateful AI agents
|
|
||||||
# Builds the Honcho FastAPI server from the official GitHub repository.
|
|
||||||
#
|
|
||||||
# Usage:
|
|
||||||
# docker compose build honcho
|
|
||||||
# docker compose up honcho
|
|
||||||
#
|
|
||||||
# Reference: https://github.com/plastic-labs/honcho
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Stage 1 — clone source & install dependencies
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
FROM python:3.13-slim-bookworm AS builder
|
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
|
|
||||||
|
|
||||||
WORKDIR /src
|
|
||||||
RUN git clone --depth 1 --branch main https://github.com/plastic-labs/honcho.git .
|
|
||||||
|
|
||||||
ENV UV_COMPILE_BYTECODE=1
|
|
||||||
ENV UV_LINK_MODE=copy
|
|
||||||
|
|
||||||
# Install project dependencies (frozen from lockfile, no dev)
|
|
||||||
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
||||||
uv sync --frozen --no-install-project --no-group dev
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Stage 2 — runtime image
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
FROM python:3.13-slim-bookworm AS runtime
|
|
||||||
|
|
||||||
COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
|
|
||||||
|
|
||||||
RUN apt-get update && \
|
|
||||||
apt-get install -y --no-install-recommends ca-certificates && \
|
|
||||||
rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
WORKDIR /app
|
|
||||||
|
|
||||||
ENV UV_COMPILE_BYTECODE=1
|
|
||||||
ENV UV_LINK_MODE=copy
|
|
||||||
ENV PYTHONDONTWRITEBYTECODE=1
|
|
||||||
ENV PYTHONUNBUFFERED=1
|
|
||||||
ENV PATH="/app/.venv/bin:$PATH"
|
|
||||||
ENV HOME=/app
|
|
||||||
ENV UV_CACHE_DIR=/tmp/uv-cache
|
|
||||||
|
|
||||||
# Copy the dependency layer from the builder
|
|
||||||
COPY --from=builder /src/uv.lock /src/pyproject.toml /app/
|
|
||||||
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
||||||
uv sync --frozen --no-group dev
|
|
||||||
|
|
||||||
# Copy application source and config
|
|
||||||
COPY --from=builder /src/src/ /app/src/
|
|
||||||
COPY --from=builder /src/migrations/ /app/migrations/
|
|
||||||
COPY --from=builder /src/scripts/ /app/scripts/
|
|
||||||
COPY --from=builder /src/docker/ /app/docker/
|
|
||||||
COPY --from=builder /src/alembic.ini /app/alembic.ini
|
|
||||||
|
|
||||||
# Create non-root user
|
|
||||||
RUN addgroup --system app && \
|
|
||||||
adduser --system --ingroup app app && \
|
|
||||||
mkdir -p /tmp/uv-cache && \
|
|
||||||
chown -R app:app /app /tmp/uv-cache
|
|
||||||
|
|
||||||
USER app
|
|
||||||
EXPOSE 8000
|
|
||||||
|
|
||||||
# The entrypoint.sh script runs database migrations then starts the FastAPI server
|
|
||||||
ENTRYPOINT ["sh", "docker/entrypoint.sh"]
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
CREATE EXTENSION IF NOT EXISTS vector;
|
|
||||||
@@ -1,93 +0,0 @@
|
|||||||
# Honcho Configuration
|
|
||||||
# Pre-configured for self-hosted deployment with Ollama embeddings.
|
|
||||||
# Mount this file at /app/config.toml in the Honcho container.
|
|
||||||
#
|
|
||||||
# Environment variables override these values at runtime
|
|
||||||
# (e.g. DB_CONNECTION_URI, DERIVER_*).
|
|
||||||
|
|
||||||
[app]
|
|
||||||
LOG_LEVEL = "INFO"
|
|
||||||
NAMESPACE = "honcho"
|
|
||||||
SESSION_OBSERVERS_LIMIT = 10
|
|
||||||
GET_CONTEXT_MAX_TOKENS = 16384
|
|
||||||
EMBED_MESSAGES = true
|
|
||||||
|
|
||||||
[db]
|
|
||||||
# Connection URI is set via environment variable DB_CONNECTION_URI
|
|
||||||
SCHEMA = "public"
|
|
||||||
POOL_SIZE = 10
|
|
||||||
MAX_OVERFLOW = 20
|
|
||||||
POOL_TIMEOUT = 30
|
|
||||||
POOL_RECYCLE = 300
|
|
||||||
POOL_PRE_PING = true
|
|
||||||
POOL_USE_LIFO = true
|
|
||||||
SQL_DEBUG = false
|
|
||||||
|
|
||||||
[auth]
|
|
||||||
USE_AUTH = false
|
|
||||||
|
|
||||||
[llm]
|
|
||||||
DEFAULT_MAX_TOKENS = 4096
|
|
||||||
|
|
||||||
[embedding]
|
|
||||||
VECTOR_DIMENSIONS = 768
|
|
||||||
MAX_INPUT_TOKENS = 8192
|
|
||||||
MAX_TOKENS_PER_REQUEST = 2048
|
|
||||||
|
|
||||||
[embedding.model_config]
|
|
||||||
transport = "openai"
|
|
||||||
model = "nomic-embed-text:latest"
|
|
||||||
|
|
||||||
[embedding.model_config.overrides]
|
|
||||||
base_url = "http://ollama:11434/v1"
|
|
||||||
# Ollama does not require an API key; env var must be set to non-empty string
|
|
||||||
api_key_env = "LLM_OPENAI_API_KEY"
|
|
||||||
|
|
||||||
[deriver]
|
|
||||||
ENABLED = false
|
|
||||||
WORKERS = 1
|
|
||||||
POLLING_SLEEP_INTERVAL_SECONDS = 1.0
|
|
||||||
STALE_SESSION_TIMEOUT_MINUTES = 5
|
|
||||||
DEDUPLICATE = true
|
|
||||||
LOG_OBSERVATIONS = false
|
|
||||||
|
|
||||||
[deriver.model_config]
|
|
||||||
transport = "openai"
|
|
||||||
model = "qwen3.6:27b-q4_K_M"
|
|
||||||
|
|
||||||
[deriver.model_config.overrides]
|
|
||||||
base_url = "http://ollama:11434/v1"
|
|
||||||
api_key_env = "LLM_OPENAI_API_KEY"
|
|
||||||
|
|
||||||
[summary]
|
|
||||||
ENABLED = false
|
|
||||||
|
|
||||||
[summary.model_config]
|
|
||||||
transport = "openai"
|
|
||||||
model = "qwen3.6:27b-q4_K_M"
|
|
||||||
|
|
||||||
[summary.model_config.overrides]
|
|
||||||
base_url = "http://ollama:11434/v1"
|
|
||||||
api_key_env = "LLM_OPENAI_API_KEY"
|
|
||||||
|
|
||||||
[dream]
|
|
||||||
ENABLED = false
|
|
||||||
|
|
||||||
[dialectic]
|
|
||||||
MAX_OUTPUT_TOKENS = 4096
|
|
||||||
MAX_INPUT_TOKENS = 16384
|
|
||||||
|
|
||||||
[cache]
|
|
||||||
ENABLED = false
|
|
||||||
|
|
||||||
[vector_store]
|
|
||||||
TYPE = "pgvector"
|
|
||||||
|
|
||||||
[metrics]
|
|
||||||
ENABLED = false
|
|
||||||
|
|
||||||
[telemetry]
|
|
||||||
ENABLED = false
|
|
||||||
|
|
||||||
[sentry]
|
|
||||||
ENABLED = false
|
|
||||||
31
env/.env.example.honcho
vendored
31
env/.env.example.honcho
vendored
@@ -1,31 +0,0 @@
|
|||||||
# Honcho Environment Variables
|
|
||||||
# Copy this file to your .env (at the compose root or docker-compose working directory)
|
|
||||||
# and fill in the secrets.
|
|
||||||
#
|
|
||||||
# cp env/.env.example.honcho .env
|
|
||||||
#
|
|
||||||
# Then reference it from compose.yml:
|
|
||||||
# env_file:
|
|
||||||
# - path: .env
|
|
||||||
# required: true
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Database
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# PostgreSQL connection string for Honcho.
|
|
||||||
# The password must match HONCHO_DB_PASSWORD below.
|
|
||||||
HONCHO_DB_PASSWORD=change_me_to_a_strong_random_password
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# LLM Provider
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Ollama does not require a real API key, but the env var must be set to a
|
|
||||||
# non-empty string for the OpenAI-compatible client to connect.
|
|
||||||
LLM_OPENAI_API_KEY=ollama
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Honcho Server
|
|
||||||
# ---------------------------------------------------------------------------
|
|
||||||
# Honcho will pick up DB_CONNECTION_URI from the compose environment.
|
|
||||||
# You can override additional settings here if needed.
|
|
||||||
# LOG_LEVEL=INFO
|
|
||||||
Reference in New Issue
Block a user