Merge remote-tracking branch 'origin/master' into local_changes

# Conflicts: # ai/compose.yml
Merge pull request 'feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support' (#54 ) from feat/hermes43-llamacpp into master
2026-07-07 15:04:00 -04:00 · 2026-07-07 19:00:03 +00:00 · 2026-07-07 14:58:44 -04:00 · 2026-07-07 14:50:59 -04:00 · 2026-07-07 14:29:23 -04:00 · 2026-07-07 14:11:31 -04:00
15 changed files with 225 additions and 171 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -1,44 +1,21 @@
 services:

-  # webui:
-  #   image: ghcr.io/open-webui/open-webui:main
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
-  #   restart: always
-  #   environment:
-  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-http.entrypoints=web"
-  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
-
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
-  #     - "traefik.http.routers.webui-https.tls=true"
-  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
-
  hermes:
    build:
      context: ./hermes
      ssh:
        - default
    container_name: hermes
-    user: "10000:10000"
    entrypoint: ["/bin/bash", "-c",
-      "bash /opt/data/hermes-tools/install.sh && bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
      "hermes-entrypoint"]
    restart: always
    # Gateway run enables the internal API server on port 8642
    command: gateway run
    environment:
-      - OLLAMA_HOST=http://ollama:11434
+      - HERMES_UID=10000
+      - HERMES_GID=10000
+      - OLLAMA_HOST=http://ollama-cpu:11434
      - HERMES_DASHBOARD=1
      # Multi-profile: comma-separated list of profiles to run as gateways.
      # The entrypoint reads this and starts one gateway per profile.
@@ -60,10 +37,7 @@ services:
      - TZ=America/Montreal
    volumes:
      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      # Syncthing-shared org files — read-only view of user's agenda
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
-      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
@@ -110,31 +84,36 @@ services:
      - "21027:21027/udp"
    environment:
      - TZ=America/Montreal
+      - PUID=10000
+      - PGID=10000
    volumes:
-      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
    networks:
      - ai_backend
      - ai_net
    labels:
      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
      - "traefik.http.routers.syncthing-http.entrypoints=web"
      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+
      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
      - "traefik.http.routers.syncthing-https.tls=true"
      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.routers.syncthing-https.middlewares=hermes-auth"
+
      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"

-
-  ollama:
+  ollama-cpu:
    build:
      context: ./ollama
      dockerfile: Dockerfile
    image: ollama/ollama:rocm-gfx906
-    container_name: ollama
+    container_name: ollama-cpu
    tty: true
    restart: always 
    ports:
@@ -147,6 +126,41 @@ services:
      - OLLAMA_VULKAN=0
      - OLLAMA_HOST=0.0.0.0

+  llama-cpp-hermes:
+    image: llama-cpp:rocm-gfx906
+    container_name: llama-cpp-hermes
+    restart: unless-stopped
+    networks:
+      - ai_backend
+    ports:
+      - "127.0.0.1:8300:8080"
+    ipc: host
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+    environment:
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HSA_ENABLE_SDMA=0
+      - HIP_VISIBLE_DEVICES=0,1
+      - LLAMA_CACHE=/models
+    volumes:
+      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
+    command: >
+      -m /model.gguf
+      --host 0.0.0.0
+      --port 8080
+      --gpu-layers 99
+      --ctx-size 163840
+      -ctk f16 -ctv f16
+      --flash-attn on
+      --split-mode layer
+      --no-mmap
+      --n-predict -1
+
  # --- Honcho + OpenConcho combiné: API + Web UI nginx/FastAPI ---
  honcho:
    build:
@@ -189,10 +203,8 @@ services:
      # Service Loadbalancer (nginx port)
      - "traefik.http.services.honcho.loadbalancer.server.port=80"
    depends_on:
-      honcho-db:
-        condition: service_healthy
-      honcho-redis:
-        condition: service_healthy
+      - honcho-db
+      - honcho-redis

  honcho-db:
    image: pgvector/pgvector:pg15
@@ -211,11 +223,6 @@ services:
      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - ai_backend
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
-      interval: 5s
-      timeout: 5s
-      retries: 5

  honcho-redis:
    image: redis:8
@@ -227,15 +234,10 @@ services:
      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
    networks:
      - ai_backend
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping"]
-      interval: 5s
-      timeout: 5s
-      retries: 5

 networks:
  ai_net:
-    external: true
+    driver: bridge
    name: ai_net
  ai_backend:
    driver: bridge
@@ -243,44 +245,9 @@ networks:

 volumes:
  honcho_data:
-    external: true
+    driver: bridge
    name: honcho_data
    
-  llama-cpp-hermes:
-    image: llama-cpp:rocm-gfx906
-    container_name: llama-cpp-hermes
-    restart: unless-stopped
-    networks:
-      - ai_backend
-    ports:
-      - "127.0.0.1:8300:8080"
-    ipc: host
-    devices:
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-    environment:
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HSA_ENABLE_SDMA=0
-      - HIP_VISIBLE_DEVICES=0,1
-      - LLAMA_CACHE=/models
-    volumes:
-      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-    command: >
-      -m /model.gguf
-      --host 0.0.0.0
-      --port 8080
-      --gpu-layers 99
-      --ctx-size 163840
-      -ctk f16 -ctv f16
-      --flash-attn on
-      --split-mode layer
-      --no-mmap
-      --n-predict -1
-
  # vllm:
  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
  #   container_name: vllm
@@ -327,6 +294,30 @@ volumes:
  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
  #   restart: unless-stopped

+  # webui:
+  #   image: ghcr.io/open-webui/open-webui:main
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
  # n8n:
  #   image: n8nio/n8n:latest
  #   container_name: n8n
--- a/ai/hermes/Dockerfile
+++ b/ai/hermes/Dockerfile
@@ -9,26 +9,6 @@
 # ---------- Base: official Hermes image (system deps, npm, uv, Playwright) ----------
 FROM nousresearch/hermes-agent:latest

-# ---------- Overlay our forked source ----------
-# Uses SSH agent forwarding from the build host (no key baked into image).
-# --exclude node_modules/.venv keeps the base image's pre-built layers intact.
-# Only the Python source, web UI source, and config change.
-RUN --mount=type=ssh \
-    mkdir -p /root/.ssh && \
-    ssh-keyscan -p 2222 code.lazyworkhorse.net >> /root/.ssh/known_hosts 2>/dev/null && \
-    cd /tmp && \
-    GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
-    git clone --depth 1 --branch main \
-    git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
-    rm -rf fork/node_modules fork/.venv fork/.git && \
-    cp -a fork/. /opt/hermes/ && \
-    rm -rf /tmp/fork /root/.ssh/
-
-# ---------- Reinstall Python package (editable) ----------
-# Picks up source changes from our fork.
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir --no-deps -e /opt/hermes
-
 # ---------- Extra system deps ----------
 USER root
 RUN apt-get update && \
@@ -43,12 +23,6 @@ RUN apt-get update && \
 # ---------- UV ----------
 COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/

-# ---------- Matrix bridge + extra pip deps ----------
-# Previously installed inline at container startup and persisted via volume mount.
-# Now baked into the image so the fragile venv volume mount can be removed.
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir 'mautrix[encryption]' openai
-
 WORKDIR /opt/hermes

 # ---------- Matrix bridge + extra pip deps ----------
@@ -101,3 +75,8 @@ USER root
 RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py

 VOLUME [ "/opt/data" ]
+
+# Switch to the hermes user so the container runs unprivileged.
+# All child processes inherit this user — no more orphan root processes
+# that escape gosu privilege drops in the entrypoint.
+USER hermes
--- a/authentification/compose.yml
+++ b/authentification/compose.yml
@@ -32,5 +32,5 @@ services:

 networks:
  auth_net:
-    external: true
+    driver: bridge
    name: auth_net
--- a/backup/.env
+++ b/backup/.env
@@ -1 +0,0 @@
-RESTIC_PASSWORD=CVvxpEKWSydmsZ5bW9lb_UZ2NR3KAKibv00tYbyZ9-E
--- a/backup/compose.yml
+++ b/backup/compose.yml
@@ -1,44 +1,100 @@
+version: "3.8"
+
 services:
+  # kopia:
+  #   image: kopia/kopia:latest
+  #   container_name: kopia
+  #   restart: unless-stopped
+  #   # We explicitly run as root (0:0) to solve the CHDIR issue, 
+  #   # OR we make sure the host folders match UID 1000.
+  #   user: "0:0" 
+  #   command:
+  #     - server
+  #     - start
+  #     - --address=0.0.0.0:51515
+  #     - --server-username=${KOPIA_SERVER_USER}
+  #     - --server-password=${KOPIA_SERVER_PASSWORD}
+  #     - --config-file=/app/config/repository.config
+  #     - --disable-csrf-token-checks
+  #     - --insecure
+  #   environment:
+  #     - TZ=America/Montreal
+  #     - KOPIA_PASSWORD=${KOPIA_PASSWORD}
+  #     - USER=${KOPIA_USER}
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
+  #     - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
+  #     - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
+  #     # Required if you want to use the 'Mount' feature later
+  #     - /tmp:/tmp:shared
+  #     # Required for mounting backups as drives
+  #   cap_add:
+  #     - SYS_ADMIN
+  #   devices:
+  #     - /dev/fuse:/dev/fuse
+  #   networks:
+  #     - traefik-net
+  #   labels:
+  #     - "traefik.enable=true"
+  #     # 1. HTTP to HTTPS Redirect
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia-http.entrypoints=web"
+  #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+  #     
+  #     # 2. HTTPS Configuration
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia.entrypoints=websecure"
+  #     - "traefik.http.routers.kopia.tls=true"
+  #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
+  #     
+  #     # 3. Backend Service Config
+  #     - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+
  restic-server:
-    image: restic/rest-server:latest
+    image: restic/restic:latest
    container_name: restic-server
    restart: always 
    user: "0:0"
-    command: ["rest-server", "--listen", ":8080", "--path", "/data", "--no-auth"]
+    command: ["server", "--listen", ":8080", "--repo", "/data", "--tls-cert", "", "--tls-key", ""]
    environment:
      - TZ=America/Montreal
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
    volumes:
      - /mnt/HoardingCow_docker_data/Restic/data:/data
+      # Mount paths to backup (adjust as needed)
+      - /mnt/HoardingCow_docker_data:/source:ro
    networks:
      - backup_net
    labels:
-      - "traefik.enable=false"
+      - "traefik.enable=false" # Internal only, accessed by restic-browser

-  restic-browser:
-    image: floibach/restic-browser:latest
-    container_name: restic-browser
-    restart: always
-    ports:
-      - "8081:8080"
-    environment:
-      - TZ=America/Montreal
-    volumes:
-      - /mnt/HoardingCow_docker_data/Restic:/repo:ro
-      - /mnt/HoardingCow_docker_data/Restic/browser-data:/data
-    networks:
-      - backup_net
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.restic-browser-http.entrypoints=web"
-      - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
-      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.restic-browser.entrypoints=websecure"
-      - "traefik.http.routers.restic-browser.tls=true"
-      - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
-      - "traefik.http.services.restic-browser.loadbalancer.server.port=8080"
+# restic-browser:
+#   image: mazzolino/restic-browser:latest
+#   container_name: restic-browser
+#   restart: always 
+#   environment:
+#     - TZ=America/Montreal
+#     - RESTIC_REPOSITORY=http://restic-server:8080
+#     - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+#   networks:
+#     - backup_net
+#   labels:
+#     - "traefik.enable=true"
+#     # 1. HTTP to HTTPS Redirect
+#     - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
+#     - "traefik.http.routers.restic-browser-http.entrypoints=web"
+#     - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
+#     
+#     # 2. HTTPS Configuration
+#     - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
+#     - "traefik.http.routers.restic-browser.entrypoints=websecure"
+#     - "traefik.http.routers.restic-browser.tls=true"
+#     - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
+#     
+#     # 3. Backend Service Config
+#     - "traefik.http.services.restic-browser.loadbalancer.server.port=8000"

 networks:
  backup_net:
-    external: true
+    driver: bridge
    name: backup_net
--- a/cloudstorage/compose.yml
+++ b/cloudstorage/compose.yml
@@ -6,6 +6,7 @@ services:
    restart: always
    networks:
      - cloud_net
+      - cloud_internal
    environment:
      - PUID=1000
      - PGID=1000
@@ -51,7 +52,7 @@ services:
    container_name: nextcloud_cron
    restart: always 
    networks:
-      - cloud_net
+      - cloud_internal
    entrypoint: /cron.sh
    volumes:
      - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
@@ -75,7 +76,7 @@ services:

 networks:
  cloud_net:
-    external: true
+    driver: bridge
    name: cloud_net
  cloud_internal:
    driver: bridge
--- a/coms/compose.yml
+++ b/coms/compose.yml
@@ -103,7 +103,7 @@ services:

 networks:
  coms_net:
-    external: true
+    driver: bridge
    name: coms_net
  coms_backend:
    driver: bridge
--- a/finance/compose.yml
+++ b/finance/compose.yml
@@ -37,4 +37,5 @@ services:

 networks:
  finance_net:
-    external: true
+    driver: bridge
+    name: finance_net
--- a/homeautomation/compose.yml
+++ b/homeautomation/compose.yml
@@ -12,8 +12,8 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Home_Assistant:/config:rw
    networks:
-      - home_auto_net
-      - home_auto_backend
+      - home_net
+      - home_backend
    labels:
      - "traefik.enable=true"

@@ -34,7 +34,7 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/Mosquitto:/mosquitto
    networks:
-      - home_auto_backend
+      - home_backend
    # ports:
    #   - 1883:1883
    #   - 9001:9001
@@ -43,7 +43,7 @@ services:
    image: registry.gitlab.com/hydroqc/hydroqc2mqtt:1.3.0
    restart: always
    networks:
-      - home_auto_backend
+      - home_backend
    environment:
      MQTT_USERNAME: hass
      MQTT_PASSWORD: ${MQTT_PASSWORD}
@@ -88,8 +88,9 @@ services:
  #   restart: unless-stopped

 networks:
-  home_auto_net:
-    external: true
-  home_auto_backend:
+  home_net:
    driver: bridge
-    name: home_auto_backend
+    name: home_net
+  home_backend:
+    driver: bridge
+    name: home_backend
--- a/homepage/compose.yml
+++ b/homepage/compose.yml
@@ -38,4 +38,5 @@ services:

 networks:
  homepage_net:
-    external: true
+    driver: bridge
+    name: homepage_net
--- a/network/compose.yml
+++ b/network/compose.yml
@@ -36,9 +36,9 @@ services:
      - cloud_net
      - coms_net
      - finance_net
-      - home_auto_net
+      - home_net
      - homepage_net
-      - passman_net
+      - pass_net
      - tak_net
      - vc_net

@@ -99,15 +99,15 @@ networks:
  finance_net:
    driver: bridge
    name: finance_net
-  home_auto_net:
+  home_net:
    driver: bridge
-    name: home_auto_net
+    name: home_net
  homepage_net:
    driver: bridge
    name: homepage_net
-  passman_net:
+  pass_net:
    driver: bridge
-    name: passman_net
+    name: pass_net
  tak_net:
    driver: bridge
    name: tak_net
--- a/passwordmanager/compose.yml
+++ b/passwordmanager/compose.yml
@@ -13,7 +13,7 @@ services:
    volumes:
      - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
    networks:
-      - passman_net
+      - pass_net
    restart: always
    labels:
      - "traefik.enable=true"
@@ -32,5 +32,6 @@ services:
      # Internal service
      - "traefik.http.services.pass.loadbalancer.server.port=80"
 networks:
-  passman_net:
-    external: true
+  pass_net:
+    driver: bridge
+    name: pass_net
--- a/tak/compose.yml
+++ b/tak/compose.yml
@@ -92,7 +92,8 @@ services:

 networks:
  tak_net:
-    external: true
+    driver: bridge
+    name: tak_net
  tak_backend:
    driver: bridge
    name: tak_backend
--- a/versioncontrol/compose.yml
+++ b/versioncontrol/compose.yml
@@ -61,4 +61,5 @@ services:

 networks:
  vc_net:
-    external: true
+    driver: bridge
+    name: vc_net
--- a/vpn/compose.yml
+++ b/vpn/compose.yml
@@ -12,7 +12,7 @@ services:
      - SYS_MODULE
    environment:
      - WG_HOST=vpn.lazyworkhorse.net
-      - PASSWORD=${WG_PASSWORD}
+      - PASSWORD_HASH=${WG_PASSWORD_HASH}
      - WG_PORT=51820
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
@@ -22,7 +22,6 @@ services:
      - UI_CHART_TYPE=0
    ports:
      - "51820:51820/udp"
-      - "51821:51821/tcp"
    volumes:
      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
    sysctls:
@@ -31,8 +30,31 @@ services:
    restart: unless-stopped
    networks:
      - vpn_net
+    labels:
+      - "traefik.enable=true"
+
+      # HTTP → HTTPS redirect
+      - "traefik.http.routers.wireguard-http.rule=Host(vpn.lazyworkhorse.net)"
+      - "traefik.http.routers.wireguard-http.entrypoints=web"
+      - "traefik.http.routers.wireguard-http.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+      # HTTPS router — protégé par Authelia
+      - "traefik.http.routers.wireguard-https.rule=Host(vpn.lazyworkhorse.net)"
+      - "traefik.http.routers.wireguard-https.entrypoints=websecure"
+      - "traefik.http.routers.wireguard-https.tls=true"
+      - "traefik.http.routers.wireguard-https.tls.certresolver=njalla"
+      - "traefik.http.routers.wireguard-https.middlewares=wireguard-auth"
+
+      # Authelia forwardAuth
+      - "traefik.http.middlewares.wireguard-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
+      - "traefik.http.middlewares.wireguard-auth.forwardauth.trustforwardheader=true"
+      - "traefik.http.middlewares.wireguard-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
+
+      # Port interne du web UI wg-easy
+      - "traefik.http.services.wireguard.loadbalancer.server.port=51821"

 networks:
  vpn_net:
-    external: true
+    driver: bridge
    name: vpn_net
Author	SHA1	Message	Date
Hermes	dab1ecfdd7	Merge remote-tracking branch 'origin/master' into local_changes Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details # Conflicts: # ai/compose.yml	2026-07-07 15:04:00 -04:00
Thierry Pouplier	e595381173	Merge pull request 'feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support' (#54 ) from feat/hermes43-llamacpp into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #54	2026-07-07 19:00:03 +00:00
Hermes	54e0661396	fix: add missing USER hermes at end of Dockerfile The Dockerfile was switching to USER root for the final chown but never switched back to USER hermes. This caused ALL container processes to run as root (uid 0) instead of the hermes user (uid 10000). The entrypoint's gosu privilege drop only caught the main exec chain, leaving backgrounded subprocesses (dashboard PTY sessions, workers with start_new_session=True) running as root — creating files owned by root in ExoKortex and breaking Syncthing sync. Adding USER hermes at the end ensures the container runs unprivileged and ALL child processes inherit uid 10000 from the start.	2026-07-07 14:58:44 -04:00
Hermes	1e290410de	Merge branch 'master' into feat/hermes43-llamacpp Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details Conflicts resolved: - hermes env: keep OLLAMA_HOST=ollama-cpu + master's new vars - ollama→ollama-cpu rename: keep our rename over master's ollama	2026-07-07 14:50:59 -04:00
Hermes	80c9906757	fix: rename ollama→ollama-cpu, fix llama-cpp-hermes YAML indentation Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Rename ollama service to ollama-cpu (CPU-only for bge-m3 embeddings) - Fix llama-cpp-hermes indented under networks instead of as top-level service - Update hermes OLLAMA_HOST to point to ollama-cpu Part of PR #54 GPU/ROCm refactor	2026-07-07 14:29:23 -04:00
Thierry Pouplier	2571930efa	Local change dump	2026-07-07 14:11:31 -04:00
Hermes	3c92d93366	feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build - Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs - Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings) Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.	2026-06-11 11:41:42 -04:00
				`@@ -1 +0,0 @@`
				`RESTIC_PASSWORD=CVvxpEKWSydmsZ5bW9lb_UZ2NR3KAKibv00tYbyZ9-E`