fix: replace Coqui/ROCm with Piper TTS (simpler, local, CPU)

Reviewed-on: #16

ai/Dockerfile

@@ -1,71 +1,91 @@
-FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
-FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
-FROM debian:13.4
+# 1. On récupère la version la plus récente d'UV
+FROM ghcr.io/astral-sh/uv:latest AS uv_source
+
+# 2. Image de base stable
+FROM debian:stable-slim
 
 # Disable Python stdout buffering to ensure logs are printed immediately
 ENV PYTHONUNBUFFERED=1
 
-# Store Playwright browsers outside the volume mount so the build-time
-# install survives the /opt/data volume overlay at runtime.
-ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
-
 # Install system dependencies in one layer, clear APT cache
 # tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
-# that would otherwise accumulate when hermes runs as PID 1. See #15012.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
         curl poppler-utils imagemagick \
-        chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
-        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
         qemu-user-static binfmt-support qemu-user-binfmt \
         emacs-nox \
         libportaudio2 && \
     rm -rf /var/lib/apt/lists/*
 
-# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
+# Création de l'utilisateur 'hermes' directement avec les bons accès
 RUN useradd -u 10000 -m -d /opt/data hermes
 
-COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
-COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
+# Copie d'uv (dernière version)
+COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
 
 WORKDIR /opt/hermes
 
-# ---------- Layer-cached dependency install ----------
-# Copy only package manifests first so npm install + Playwright are cached
-# unless the lockfiles themselves change.
-COPY package.json package-lock.json ./
-COPY web/package.json web/package-lock.json web/
+# On donne la propriété du dossier de travail à l'utilisateur hermes
+RUN chown hermes:hermes /opt/hermes
 
-RUN npm install --prefer-offline --no-audit && \
-    npx playwright install --with-deps chromium --only-shell && \
-    (cd web && npm install --prefer-offline --no-audit) && \
-    npm cache clean --force
+# ---------- Hermes venv ----------
+# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
+USER hermes
 
 # ---------- Source code ----------
-# .dockerignore excludes node_modules, so the installs above survive.
+# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
 COPY --chown=hermes:hermes . .
 
-# Build web dashboard (Vite outputs to hermes_cli/web_dist/)
-RUN cd web && npm run build
-
-# ---------- Permissions ----------
-# Make install dir world-readable so any HERMES_UID can read it at runtime.
-# The venv needs to be traversable too.
-USER root
-RUN chmod -R a+rX /opt/hermes
-# Start as root so the entrypoint can usermod/groupmod + gosu.
-# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).
-
 # ---------- Python virtualenv ----------
 RUN uv venv && \
-    uv pip install --no-cache-dir -e ".[all]" && \
     uv pip install --no-cache-dir sounddevice numpy faster-whisper
 
+# ---------- Patch tts_tool.py to add Coqui provider ----------
+RUN /opt/hermes/.venv/bin/python3 -c "
+tts_path = '/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py'
+with open(tts_path) as f:
+    code = f.read()
+coqui_block = '''
+        elif provider == \"coqui\":
+            logger.info(\"Generating speech with Coqui TTS (GPU, local)...\")
+            import subprocess
+            coqui_python = \"/opt/coqui-tts/bin/python3\"
+            coqui_script = \"/opt/coqui-tts/bin/coqui_synth.py\"
+            coqui_config = tts_config.get(\"coqui\", {})
+            model = coqui_config.get(\"model\", \"tts_models/en/vctk/vits\")
+            use_gpu = coqui_config.get(\"use_gpu\", True)
+            speaker = coqui_config.get(\"speaker\", \"\")
+            cmd = [
+                coqui_python, coqui_script,
+                \"--text\", text,
+                \"--out\", file_str,
+                \"--model\", model,
+            ]
+            if use_gpu:
+                cmd.append(\"--gpu\")
+            if speaker:
+                cmd.extend([\"--speaker\", speaker])
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+            if result.returncode != 0:
+                stderr = result.stderr.strip()
+                raise RuntimeError(f\"Coqui TTS failed: {stderr or 'unknown error'}\")
+            logger.info(\"Coqui TTS audio saved: %s\", file_str)
+'''
+code = code.replace(
+    '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback',
+    coqui_block + '        else:\n            # Default: Edge TTS (free), with NeuTTS as local fallback'
+)
+with open(tts_path, 'w') as f:
+    f.write(code)
+"
+
 # ---------- Runtime ----------
-ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"
+
 VOLUME [ "/opt/data" ]
+
+# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
 ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]

ai/compose.yml

@@ -38,7 +38,13 @@ services:
       - API_SERVER_HOST=0.0.0.0
       - API_SERVER_KEY=hermes_local_key
       - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      - OPENROUTER_API_KEY=${OPEN...KEY}
+      # ROCm for GPU-accelerated faster-whisper STT
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     devices:

network/compose.yml

@@ -13,17 +13,20 @@ services:
       - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
       - "--certificatesresolvers.njalla.acme.httpchallenge.entrypoint=web"
 
-      - "--log.level=DEBUG"
+      - "--log.level=INFO"
+      - "--log.filepath=/var/log/traefik/traefik.log"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--providers.docker=true"
       - "--providers.docker.exposedByDefault=false"
     ports:
       - "80:80"
       - "443:443"
     environment:
-      - NJALLA_TOKEN=${NJALLA_TOKEN}
+      - NJALLA_TOKEN=***
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
+      - /var/log/traefik:/var/log/traefik
     restart: unless-stopped
     networks:
       - traefik_backend