fix: use full OPENROUTER_API_KEY variable name

Reviewed-on: #16

ai/Dockerfile

@@ -1,71 +1,66 @@
-FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
-FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
-FROM debian:13.4
+# 1. On récupère la version la plus récente d'UV
+FROM ghcr.io/astral-sh/uv:latest AS uv_source
+
+# 2. Image de base stable
+FROM debian:stable-slim
 
 # Disable Python stdout buffering to ensure logs are printed immediately
 ENV PYTHONUNBUFFERED=1
 
-# Store Playwright browsers outside the volume mount so the build-time
-# install survives the /opt/data volume overlay at runtime.
-ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
-
 # Install system dependencies in one layer, clear APT cache
 # tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
-# that would otherwise accumulate when hermes runs as PID 1. See #15012.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
         curl poppler-utils imagemagick \
-        chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
-        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
         qemu-user-static binfmt-support qemu-user-binfmt \
         emacs-nox \
         libportaudio2 && \
     rm -rf /var/lib/apt/lists/*
 
-# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
+# Création de l'utilisateur 'hermes' directement avec les bons accès
 RUN useradd -u 10000 -m -d /opt/data hermes
 
-COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
-COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
+# Copie d'uv (dernière version)
+COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
 
 WORKDIR /opt/hermes
 
-# ---------- Layer-cached dependency install ----------
-# Copy only package manifests first so npm install + Playwright are cached
-# unless the lockfiles themselves change.
-COPY package.json package-lock.json ./
-COPY web/package.json web/package-lock.json web/
+# On donne la propriété du dossier de travail à l'utilisateur hermes
+RUN chown hermes:hermes /opt/hermes
 
-RUN npm install --prefer-offline --no-audit && \
-    npx playwright install --with-deps chromium --only-shell && \
-    (cd web && npm install --prefer-offline --no-audit) && \
-    npm cache clean --force
+# ---------- Hermes venv ----------
+# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
+USER hermes
 
 # ---------- Source code ----------
-# .dockerignore excludes node_modules, so the installs above survive.
+# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
 COPY --chown=hermes:hermes . .
 
-# Build web dashboard (Vite outputs to hermes_cli/web_dist/)
-RUN cd web && npm run build
-
-# ---------- Permissions ----------
-# Make install dir world-readable so any HERMES_UID can read it at runtime.
-# The venv needs to be traversable too.
-USER root
-RUN chmod -R a+rX /opt/hermes
-# Start as root so the entrypoint can usermod/groupmod + gosu.
-# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).
-
-# ---------- Python virtualenv ----------
+# ---------- Python virtualenv avec Piper TTS ----------
 RUN uv venv && \
-    uv pip install --no-cache-dir -e ".[all]" && \
-    uv pip install --no-cache-dir sounddevice numpy faster-whisper
+    uv pip install --no-cache-dir piper-tts sounddevice numpy faster-whisper
+
+# ---------- Télécharger la voix Piper Ryan ----------
+RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
+    /opt/hermes/.venv/bin/python3 -c "
+import urllib.request
+base = '/opt/hermes/.venv/share/piper/voices'
+url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
+urllib.request.urlretrieve(url + '?download=true', base + '/en_US-ryan-high.onnx')
+urllib.request.urlretrieve(url + '.onnx.json?download=true', base + '/en_US-ryan-high.onnx.json')
+"
+
+# ---------- Patch tts_tool.py: remplacer Coqui par Piper, supprimer Edge ----------
+COPY ai/patch_tts_tool.py /tmp/patch_tts_tool.py
+RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
 
 # ---------- Runtime ----------
-ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"
+
 VOLUME [ "/opt/data" ]
+
+# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
 ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]

ai/compose.yml

@@ -39,6 +39,12 @@ services:
       - API_SERVER_KEY=hermes_local_key
       - GATEWAY_ALLOW_ALL_USERS=true
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      # ROCm for GPU-accelerated faster-whisper STT
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     devices:

ai/patch_tts_tool.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""Patch Hermes TTS tool to add Piper provider and remove Edge TTS fallback."""
+import sys
+
+tts_path = '/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py'
+
+with open(tts_path) as f:
+    code = f.read()
+
+# Replace the Coqui provider block with Piper
+old_coqui = '        elif provider == "coqui":'
+new_piper = '''        elif provider == "piper":
+            logger.info("Generating speech with Piper TTS (local, CPU)...")
+            import subprocess
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if not os.path.exists(model_path):
+                raise FileNotFoundError(f"Piper voice model not found: {model_path}")
+            cmd = [piper_binary, "--model", model_path, "--output-raw"]
+            proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+            if proc.returncode != 0:
+                raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+            ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+            subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+            logger.info("Piper TTS audio saved: %s", file_str)'''
+
+if old_coqui in code:
+    code = code.replace(old_coqui, new_piper)
+    print("Coqui -> Piper replaced")
+else:
+    # Fresh Hermes install - add Piper after the last provider (kittentts)
+    if 'provider == "piper"' in code:
+        print("Piper already present, skipping coqui replacement")
+    else:
+        print("Stock Hermes - adding Piper provider after kittentts...")
+        marker = '        elif provider == "kittentts":'
+        if marker in code:
+            # Find the end of the kittentts block and insert Piper before else
+            lines = code.split('\n')
+            kit_idx = None
+            for i, line in enumerate(lines):
+                if line.strip().startswith('elif provider == "kittentts":'):
+                    kit_idx = i
+                    break
+            if kit_idx is not None:
+                # Find the next blank line + else block
+                for i in range(kit_idx, len(lines)):
+                    if lines[i].strip() == 'else:':
+                        # Insert Piper block before this line
+                        indent = '        '
+                        piper_lines = new_piper.split('\n')
+                        insert = piper_lines + ['']
+                        lines[i:i] = insert
+                        code = '\n'.join(lines)
+                        print("Piper provider added after kittentts")
+                        break
+
+# Replace the Edge fallback with Piper fallback
+old_edge = '''        else:
+            # Default: Edge TTS (free), with NeuTTS as local fallback
+            edge_available = True
+            try:
+                _import_edge_tts()
+            except ImportError:
+                edge_available = False
+
+            if edge_available:
+                logger.info("Generating speech with Edge TTS...")
+                try:
+                    import concurrent.futures
+                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                        pool.submit(
+                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+                        ).result(timeout=60)
+                except RuntimeError:
+                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+            elif _check_neutts_available():
+                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
+                provider = "neutts"
+                _generate_neutts(text, file_str, tts_config)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
+                             "or set up NeuTTS for local synthesis."
+                }, ensure_ascii=False)'''
+
+new_piper_fallback = '''        else:
+            # Default: Piper TTS (local, CPU, no cloud)
+            piper_available = False
+            try:
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                if os.path.exists(model_path):
+                    piper_available = True
+            except Exception:
+                pass
+
+            if piper_available:
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess
+                piper_binary = "/opt/hermes/.venv/bin/piper"
+                piper_config = tts_config.get("piper", {})
+                voice = piper_config.get("voice", "en_US-lessac-medium")
+                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+                model_path = os.path.join(model_dir, f"{voice}.onnx")
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                if proc.returncode != 0:
+                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                logger.info("Piper TTS audio saved: %s", file_str)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install Piper TTS (pip install piper-tts) "
+                             "and download a voice model."
+                }, ensure_ascii=False)'''
+
+if old_edge in code:
+    code = code.replace(old_edge, new_piper_fallback)
+    print("Edge fallback replaced with Piper")
+else:
+    print("Edge fallback NOT found, checking if already Piper...")
+    if 'Default: Piper TTS' in code:
+        print("Piper fallback already present, skipping")
+    else:
+        print("ERROR: Could not find Edge fallback")
+        # Debug: show what the else block looks like
+        import re
+        match = re.search(r'        else:\n            # Default:', code)
+        if match:
+            print("Found else block at", match.start())
+        sys.exit(1)
+
+with open(tts_path, 'w') as f:
+    f.write(code)
+print("tts_tool.py patched successfully")

network/compose.yml

@@ -13,17 +13,20 @@ services:
       - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
       - "--certificatesresolvers.njalla.acme.httpchallenge.entrypoint=web"
 
-      - "--log.level=DEBUG"
+      - "--log.level=INFO"
+      - "--log.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--providers.docker=true"
       - "--providers.docker.exposedByDefault=false"
     ports:
       - "80:80"
       - "443:443"
     environment:
-      - NJALLA_TOKEN=${NJALLA_TOKEN}
+      - NJALLA_TOKEN=***
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
+      - /var/log/traefik:/var/log/traefik
     restart: unless-stopped
     networks:
       - traefik_backend