hermes: fix vpn_net networks syntax (map form) for compose v5; drop dead build ssh key

feat: attach hermes to vpn_net at 172.24.0.5 for desktop remote-gateway access
fix: remove stale COPY line for deleted run-multi-gateways.sh
2026-09-15 17:18:28 -04:00 · 2026-09-15 15:28:51 -04:00 · 2026-07-07 22:33:35 -04:00 · 2026-07-08 02:25:01 +00:00 · 2026-07-07 22:21:36 -04:00 · 2026-07-08 02:04:44 +00:00
7 changed files with 176 additions and 646 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -1,220 +1,201 @@
 services:
-
  hermes:
    build:
      context: ./hermes
-      ssh:
-        - default
    container_name: hermes
    restart: always
-    # Use the image default ENTRYPOINT ["/init", "/opt/hermes/docker/main-wrapper.sh"]
-    # for proper s6-overlay supervision. The CMD runs our multi-profile launcher
-    # which spawns per-profile gateways in background, then the default gateway
-    # in foreground (keeps the container alive).
-    command: ["/usr/local/bin/start-hermes.sh"]
+    command: gateway run
    environment:
-      - HERMES_UID=10000
-      - HERMES_GID=10000
-      - OLLAMA_HOST=http://ollama:11434
-      - HERMES_DASHBOARD=1
-      # Multi-profile: comma-separated list of profiles to run as gateways.
-      # start-hermes.sh reads this and starts one gateway per profile.
-      # Add profiles here when they exist on disk (e.g. default,researcher,writer)
-      - HERMES_PROFILES=ashley,claire,finn,matt,paul
-      - API_SERVER_ENABLED=true
-      - API_SERVER_PORT=8642
-      - API_SERVER_HOST=0.0.0.0
-      - API_SERVER_KEY=hermes_local_key
-      - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-      - OPENCODE_API_KEY=${OPENCODE_API_KEY}
-      # ROCm for GPU-accelerated faster-whisper STT
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0
-      - TZ=America/Montreal
+    - HERMES_UID=10000
+    - HERMES_GID=10000
+    - OLLAMA_HOST=http://ollama-cpu:11434
+    - HERMES_DASHBOARD=1
+    - API_SERVER_ENABLED=true
+    - API_SERVER_PORT=8642
+    - API_SERVER_HOST=0.0.0.0
+    - API_SERVER_KEY=hermes_local_key
+    - GATEWAY_ALLOW_ALL_USERS=true
+    - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+    - OPENCODE_API_KEY=${OPENCODE_API_KEY}
+    - HSA_OVERRIDE_GFX_VERSION=9.0.6
+    - HCC_AMDGPU_TARGET=gfx906
+    - HIP_VISIBLE_DEVICES=0,1
+    - ROCR_VISIBLE_DEVICES=0,1
+    - HSA_ENABLE_SDMA=0
+    - TZ=America/Montreal
    volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
+    - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
    devices:
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
+    - /dev/kfd:/dev/kfd
+    - /dev/dri:/dev/dri
    group_add:
-      - "303"
-      - "26"
+    - '303'
+    - '26'
    networks:
-      - ai_backend
-      - ai_net
+      ai_backend: null
+      ai_net: null
+      vpn_net:
+        ipv4_address: 172.24.0.5
    depends_on:
-      - honcho
+    - honcho
    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=ai_net"
-
-      # Router for HTTP + redirection to HTTPS
-      - "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
-      - "traefik.http.routers.hermes-web-http.entrypoints=web"
-      - "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
-
-      # Router for HTTPS with TLS — protected by Authelia
-      - "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
-      - "traefik.http.routers.hermes-web-https.entrypoints=websecure"
-      - "traefik.http.routers.hermes-web-https.tls=true"
-      - "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
-      - "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
-
-      # Authelia forwardAuth
-      - "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
-
-      # Service Loadbalancer (dashboard port 9119)
-      - "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
-
+    - traefik.enable=true
+    - traefik.docker.network=ai_net
+    - traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)
+    - traefik.http.routers.hermes-web-http.entrypoints=web
+    - traefik.http.routers.hermes-web-http.middlewares=redirect-to-https
+    - traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)
+    - traefik.http.routers.hermes-web-https.entrypoints=websecure
+    - traefik.http.routers.hermes-web-https.tls=true
+    - traefik.http.routers.hermes-web-https.tls.certresolver=njalla
+    - traefik.http.routers.hermes-web-https.middlewares=hermes-auth
+    - traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/
+    - traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true
+    - traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups
+    - traefik.http.services.hermes-web.loadbalancer.server.port=9119
  syncthing:
    image: syncthing/syncthing:latest
    container_name: syncthing
    hostname: syncthing
    restart: always
    ports:
-      - "8384:8384"
-      - "22000:22000"
-      - "21027:21027/udp"
+    - 8384:8384
+    - 22000:22000
+    - 21027:21027/udp
    environment:
-      - TZ=America/Montreal
-      - PUID=10000
-      - PGID=10000
+    - TZ=America/Montreal
+    - PUID=10000
+    - PGID=10000
    volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
    networks:
-      - ai_backend
-      - ai_net
+    - ai_backend
+    - ai_net
    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=ai_net"
-
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.tls=true"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
-      - "traefik.http.routers.syncthing-https.middlewares=hermes-auth"
-
-      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
-
-  ollama:
+    - traefik.enable=true
+    - traefik.docker.network=ai_net
+    - traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)
+    - traefik.http.routers.syncthing-http.entrypoints=web
+    - traefik.http.routers.syncthing-http.middlewares=redirect-to-https
+    - traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)
+    - traefik.http.routers.syncthing-https.entrypoints=websecure
+    - traefik.http.routers.syncthing-https.tls=true
+    - traefik.http.routers.syncthing-https.tls.certresolver=njalla
+    - traefik.http.routers.syncthing-https.middlewares=hermes-auth
+    - traefik.http.services.syncthing.loadbalancer.server.port=8384
+  ollama-cpu:
    build:
      context: ./ollama
      dockerfile: Dockerfile
    image: ollama/ollama:rocm-gfx906
-    container_name: ollama
+    container_name: ollama-cpu
    tty: true
    restart: always
    ports:
-      - "127.0.0.1:11434:11434"
+    - 127.0.0.1:11434:11434
    networks:
-      - ai_backend
+    - ai_backend
    volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
    environment:
-      - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
-      - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=1
-      - OLLAMA_NUM_PARALLEL=2
+    - OLLAMA_VULKAN=0
+    - OLLAMA_HOST=0.0.0.0
+  llama-cpp-hermes:
+    image: llama-cpp:rocm-gfx906
+    container_name: llama-cpp-hermes
+    restart: unless-stopped
+    networks:
+    - ai_backend
+    ports:
+    - 127.0.0.1:8300:8080
+    ipc: host
    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
+    - /dev/kfd:/dev/kfd
+    - /dev/dri:/dev/dri
    group_add:
-      - "303"
-      - "26"
+    - '303'
+    - '26'
+    environment:
+    - HSA_OVERRIDE_GFX_VERSION=9.0.6
+    - HSA_ENABLE_SDMA=0
+    - HIP_VISIBLE_DEVICES=0,1
+    - LLAMA_CACHE=/models
+    volumes:
+    - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+    - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
+    command: '-m /model.gguf --host 0.0.0.0 --port 8080 --gpu-layers 99 --ctx-size
+      163840 -ctk f16 -ctv f16 --flash-attn on --split-mode layer --no-mmap --n-predict
+      -1

-  # --- Honcho + OpenConcho combiné: API + Web UI nginx/FastAPI ---
+      '
  honcho:
    build:
      context: ./honcho
      ssh:
-        - default
+      - default
    container_name: honcho
    restart: unless-stopped
    environment:
-      - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
-      - CACHE_URL=redis://honcho-redis:6379/0
-      - CACHE_ENABLED=true
-      - EMBEDDING_VECTOR_DIMENSIONS=1024
-      - AUTH_USE_AUTH=true
-      - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
-      # Needed by deriver/dream to make LLM calls (api_key_env = "HONCHO_OPENAI_API_KEY" in config.toml)
-      - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
+    - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
+    - CACHE_URL=redis://honcho-redis:6379/0
+    - CACHE_ENABLED=true
+    - EMBEDDING_VECTOR_DIMENSIONS=1024
+    - AUTH_USE_AUTH=true
+    - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
+    - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
    volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
-      - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
+    - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
+    - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
    networks:
-      - ai_backend
-      - ai_net
+    - ai_backend
+    - ai_net
    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=ai_net"
-
-      # Router for HTTP + redirect to HTTPS
-      - "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.honcho-http.entrypoints=web"
-      - "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
-
-      # Router for HTTPS with TLS — protected by Authelia
-      - "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.honcho-https.entrypoints=websecure"
-      - "traefik.http.routers.honcho-https.tls=true"
-      - "traefik.http.routers.honcho-https.tls.certresolver=njalla"
-      - "traefik.http.routers.honcho-https.middlewares=hermes-auth"
-
-      # Service Loadbalancer (nginx port)
-      - "traefik.http.services.honcho.loadbalancer.server.port=80"
+    - traefik.enable=true
+    - traefik.docker.network=ai_net
+    - traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)
+    - traefik.http.routers.honcho-http.entrypoints=web
+    - traefik.http.routers.honcho-http.middlewares=redirect-to-https
+    - traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)
+    - traefik.http.routers.honcho-https.entrypoints=websecure
+    - traefik.http.routers.honcho-https.tls=true
+    - traefik.http.routers.honcho-https.tls.certresolver=njalla
+    - traefik.http.routers.honcho-https.middlewares=hermes-auth
+    - traefik.http.services.honcho.loadbalancer.server.port=80
    depends_on:
-      - honcho-db
-      - honcho-redis
-
+    - honcho-db
+    - honcho-redis
  honcho-db:
    image: pgvector/pgvector:pg15
    container_name: honcho-db
    restart: unless-stopped
    ports:
-      - "127.0.0.1:5432:5432"
-    command: ["postgres", "-c", "max_connections=200"]
+    - 127.0.0.1:5432:5432
+    command:
+    - postgres
+    - -c
+    - max_connections=200
    environment:
-      - POSTGRES_DB=honcho
-      - POSTGRES_USER=honcho
-      - POSTGRES_PASSWORD=honcho_pass
-      - PGDATA=/var/lib/postgresql/data/pgdata
+    - POSTGRES_DB=honcho
+    - POSTGRES_USER=honcho
+    - POSTGRES_PASSWORD=honcho_pass
+    - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
-      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
+    - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
-      - ai_backend
-
+    - ai_backend
  honcho-redis:
    image: redis:8
    container_name: honcho-redis
    restart: unless-stopped
    ports:
-      - "127.0.0.1:6379:6379"
+    - 127.0.0.1:6379:6379
    volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
+    - /mnt/HoardingCow_docker_data/Honcho/redis:/data
    networks:
-      - ai_backend
-
+    - ai_backend
 networks:
  ai_net:
    driver: bridge
@@ -222,235 +203,10 @@ networks:
  ai_backend:
    driver: bridge
    name: ai_backend
-
+  vpn_net:
+    external: true
+    name: vpn_net
 volumes:
  honcho_data:
    driver: bridge
    name: honcho_data
-    
-  # llama_cpp_devstral:
-  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
-  #   container_name: llama_cpp_devstral
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_backend
-  #   ports:
-  #     - "8300:8080"
-  #   ipc: host
-  #   devices:
-  #     - "/dev/kfd:/dev/kfd"
-  #     - "/dev/dri:/dev/dri"
-  #   group_add:
-  #     - "303" # video
-  #     - "26"  # render
-  #   environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
-  #     HIP_VISIBLE_DEVICES: 0,1
-  #     LLAMA_CACHE: /models
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
-  #   command: >
-  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
-  #     -a devstral-2-small-llama_cpp
-  #     --chat-template-file /template.jinja
-  #     --host 0.0.0.0
-  #     --port 8080
-  #     --n-gpu-layers 99
-  #     --ctx-size 163840
-  #     --batch-size 4096
-  #     --ubatch-size 4096
-  #     --cache-type-k f16
-  #     --cache-type-v f16
-  #     --cache-reuse 256
-  #     --flash-attn on
-  #     --context-shift
-  #     --split-mode layer
-  #     --no-mmap
-  #     --n-predict -1
-  #     --parallel 2
-
-  # vllm:
-  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
-  #   container_name: vllm
-  #   # Required for multi-GPU communication (NCCL)
-  #   ipc: host 
-  #   init: true
-  #   shm_size: '2g' 
-  #   networks:
-  #     - ai_backend
-  #   ports:
-  #     - "8300:8000"
-  #   devices:
-  #     - "/dev/kfd:/dev/kfd"
-  #     - "/dev/dri:/dev/dri"
-  #   group_add:
-  #     - "303"
-  #     - "26"
-  #   environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
-  #     HSA_ENABLE_SDMA: 0
-  #     HIP_VISIBLE_DEVICES: 0,1
-  #     NCCL_P2P_DISABLE: 1
-  #     VLLM_WORKER_MULTIPROC_METHOD: spawn
-  #     VLLM_USE_TRITON_FLASH_ATTN: 0
-  #     VLLM_USE_ROCM_CUSTOM_PAGED_ATTN: 0
-  #     VLLM_ATTENTION_BACKEND: ROPE_NAIVE
-  #     VLLM_SKIP_WARMUP: 1
-  #     VLLM_USE_V1: 0
-  #     HF_TOKEN: ${HF_TOKEN}
-  #   command: >
-  #     vllm serve "mistralai/Devstral-Small-2-24B-Instruct-2512" 
-  #     --tensor-parallel-size 2
-  #     --max-model-len 8192
-  #     --gpu-memory-utilization 0.90
-  #     --tokenizer_mode mistral
-  #     --config_format auto
-  #     --load-format auto
-  #     --enforce-eager
-  #     --disable-custom-all-reduce
-  #     --trust-remote-code
-  #     --task generate
-  #     --block-size 16
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
-  #   restart: unless-stopped
-
-  # webui:
-  #   image: ghcr.io/open-webui/open-webui:main
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
-  #   restart: always
-  #   environment:
-  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-http.entrypoints=web"
-  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
-
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
-  #     - "traefik.http.routers.webui-https.tls=true"
-  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
-
-  # n8n:
-  #   image: n8nio/n8n:latest
-  #   container_name: n8n
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_net
-  #   environment:
-  #     - N8N_HOST=n8n.lazyworkhorse.net
-  #     - N8N_PORT=5678
-  #     - N8N_PROTOCOL=https
-  #     - NODE_ENV=production
-  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
-  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
-  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
-  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
-  #     - N8N_NATIVE_PYTHON_RUNNER=true
-  #     - N8N_PYTHON_ALLOW_STDLIB=uuid,re,os,json
-  #     - N8N_PYTHON_ALLOW_EXTERNAL=requests,pandas
-  #     - NODE_FUNCTION_ALLOW_EXTERNAL=uuid,requests
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/n8n:/home/node/.n8n
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.n8n-http.entrypoints=web"
-  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
-
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
-  #     - "traefik.http.routers.n8n-https.tls=true"
-  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
-
-  #     # Service Loadbalancer (n8n default port)
-  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
-
-  # openclaw:
-  #   image: coollabsio/openclaw:latest
-  #   container_name: openclaw
-  #   restart: unless-stopped
-  #   expose:
-  #     - "8080"  # WebUI
-  #     - "18789" # Gateway/WebSocket
-  #     - "8788"  # Nextcloud Webhook
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
-  #     - /home/gortium/infra:/data/workspace/infra
-  #   environment:
-  #     - TZ=America/Toronto
-  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-  #     # Point to the sidecar browser
-  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
-  #     - BROWSER_EVALUATE_ENABLED=true
-  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
-  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
-  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
-
-  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.openclaw-https.priority=50"
-  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
-  #     - "traefik.http.routers.openclaw-https.tls=true"
-  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
-  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
-  #   depends_on:
-  #     - openclaw-browser
-
-  # openclaw-browser:
-  #   image: ghcr.io/browserless/chromium:latest
-  #   restart: always
-  #   expose:
-  #     - "3000"
-  #   environment:
-  #     - MAX_CONCURRENT_SESSIONS=10
-  #     - CONNECTION_TIMEOUT=300000
-  #     - PREBOOT_CHROME=true
-  #     - DEMO_MODE=false
-  #   networks:
-  #     ai_backend:
-  #       aliases:
-  #         - browser
-
-  # openclaw-ssh:
-  #   image: linuxserver/openssh-server:latest
-  #   container_name: openclaw-ssh
-  #   environment:
-  #     - PUID=1000
-  #     - PGID=1000
-  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
-  #     - SUDO_ACCESS=false
-  #     - PASSWORD_ACCESS=false
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
-  #     - /home/gortium/infra:/data/workspace/infra:ro
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
-  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
-  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
-  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
-  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"
--- a/ai/hermes/Dockerfile
+++ b/ai/hermes/Dockerfile
@@ -13,6 +13,7 @@ FROM nousresearch/hermes-agent:latest
 USER root
 RUN apt-get update && \
    apt-get install -y --no-install-recommends \
+        gosu \
        libportaudio2 ca-certificates poppler-utils imagemagick \
        libolm-dev \
        texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
@@ -58,15 +59,6 @@ os.remove(tgz)
 print('himalaya v1.2.0 installed')
 PYEOF

-# ---------- Install multi-gateway launcher ----------
-# Launches one gateway process per profile (HERMES_PROFILES env var)
-COPY --chmod=0755 run-multi-gateways.sh /usr/local/bin/run-multi-gateways.sh
-
-# ---------- Install s6-overlay compatible startup script ----------
-# Runs as the CMD via s6-overlay's main-program model.
-# Replaces the old bash->tini->entrypoint.sh chain that caused SIGTERM crash loops.
-COPY --chmod=0755 start-hermes.sh /usr/local/bin/start-hermes.sh
-
 # ---------- Runtime ----------
 USER hermes
 ENV HERMES_HOME=/opt/data
--- a/ai/hermes/patch_tts_tool.py
+++ b/ai/hermes/patch_tts_tool.py
@@ -1,181 +0,0 @@
-#!/usr/bin/env python3
-"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
-
-Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
-
-Searches multiple paths for tts_tool.py so it works both at build time
-(in the image venv) and at runtime (on the mounted data volume).
-
-Idempotent: if already patched, does nothing.
-"""
-
-import sys
-import os
-
-# ---------------------------------------------------------------------------
-# Search for all copies of tts_tool.py
-# ---------------------------------------------------------------------------
-CANDIDATE_PATHS = [
-    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
-    "/opt/hermes/tools/tts_tool.py",
-]
-
-found_paths = []
-
-for p in CANDIDATE_PATHS:
-    if os.path.exists(p):
-        found_paths.append(p)
-        print(f"Found tts_tool.py at: {p}")
-
-# Also try to find via Python import
-import subprocess
-try:
-    result = subprocess.run(
-        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
-        capture_output=True, text=True, timeout=5
-    )
-    if result.returncode == 0:
-        p = result.stdout.strip()
-        if os.path.exists(p) and p not in found_paths:
-            found_paths.append(p)
-            print(f"Found tts_tool.py via import at: {p}")
-except Exception:
-    pass
-
-if not found_paths:
-    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
-    print(f"Searched: {CANDIDATE_PATHS}")
-    sys.exit(0)
-
-# ---------------------------------------------------------------------------
-# Old else block: the Edge TTS default fallback to replace
-# ---------------------------------------------------------------------------
-old_else = '''        else:
-            # Default: Edge TTS (free), with NeuTTS as local fallback
-            edge_available = True
-            try:
-                _import_edge_tts()
-            except ImportError:
-                edge_available = False
-
-            if edge_available:
-                logger.info("Generating speech with Edge TTS...")
-                try:
-                    import concurrent.futures
-                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-                        pool.submit(
-                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-                        ).result(timeout=60)
-                except RuntimeError:
-                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-            elif _check_neutts_available():
-                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
-                provider = "neutts"
-                _generate_neutts(text, file_str, tts_config)
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
-                             "or set up NeuTTS for local synthesis."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# New block: elif provider == "piper" + else: fallback with Piper only
-# ---------------------------------------------------------------------------
-new_block = '''        elif provider == "piper":
-            # Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if not os.path.exists(model_path):
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS voice model not found. "
-                             "Install Piper TTS and download a voice model."
-                }, ensure_ascii=False)
-            logger.info("Generating speech with Piper TTS (local, CPU)...")
-            import subprocess as _sp
-            cmd = [piper_binary, "--model", model_path, "--output-raw"]
-            try:
-                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                if proc.returncode != 0:
-                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
-                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-            except Exception as e:
-                return json.dumps({
-                    "success": False,
-                    "error": f"Piper TTS failed: {e}"
-                }, ensure_ascii=False)
-
-        else:
-            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if os.path.exists(model_path) and os.path.exists(piper_binary):
-                logger.info("Generating speech with Piper TTS (local, CPU)...")
-                import subprocess as _sp
-                cmd = [piper_binary, "--model", model_path, "--output-raw"]
-                try:
-                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                    if proc.returncode != 0:
-                        raise RuntimeError(stderr.decode()[:200])
-                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-                except Exception:
-                    pass
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# Apply the patch to all copies found
-# ---------------------------------------------------------------------------
-patched_any = False
-
-for tts_path in found_paths:
-    with open(tts_path) as f:
-        code = f.read()
-
-    if 'provider == "piper"' in code:
-        print(f"ALREADY PATCHED: {tts_path}")
-        continue
-
-    if old_else in code:
-        code = code.replace(old_else, new_block, 1)
-        with open(tts_path, 'w') as f:
-            f.write(code)
-        print(f"PATCHED: {tts_path}")
-        patched_any = True
-    else:
-        print(f"SKIP {tts_path}: Edge fallback pattern not found")
-        import re
-        for m in re.finditer(r'        else:\n            # Default:', code):
-            start = max(0, m.start() - 100)
-            end = min(len(code), m.end() + 300)
-            print(f"  Found 'else:/# Default:' at position {m.start()}:")
-            print(f"  {code[start:end]}")
-            print("  ---")
-        # Don't exit with error — if one copy isn't patchable, try the others
-
-if not patched_any:
-    all_patched = all(
-        'provider == "piper"' in open(p).read()
-        for p in found_paths
-    )
-    if all_patched:
-        print("All copies already patched.")
-        sys.exit(0)
-    print("WARNING: Could not patch any copy of tts_tool.py")
-    sys.exit(1)
-
-print("tts_tool.py patched successfully across all copies.")
--- a/ai/hermes/run-multi-gateways.sh
+++ b/ai/hermes/run-multi-gateways.sh
@@ -1,32 +0,0 @@
-#!/bin/bash
-# Multi-gateway launcher for HERMES_PROFILES env var.
-# Reads comma-separated profile names, spawns one gateway per profile.
-# Designed to run before the main entrypoint — gateways run in background.
-set -e
-
-if [ -z "${HERMES_PROFILES}" ]; then
-  echo "HERMES_PROFILES not set — skipping multi-gateway launch"
-  exit 0
-fi
-
-# Source venv to make 'hermes' available (entrypoint.sh sources it later,
-# but we need it NOW for the background gateways)
-HERMES_BIN="/opt/hermes/.venv/bin/hermes"
-if [ ! -x "$HERMES_BIN" ]; then
-  echo "ERROR: hermes binary not found at $HERMES_BIN"
-  exit 1
-fi
-
-mkdir -p /opt/data/logs
-
-IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
-for profile in "${PROFILES[@]}"; do
-  profile="$(echo "${profile}" | xargs)"  # trim whitespace
-  [ -z "${profile}" ] && continue
-
-  echo "Starting gateway for profile: ${profile}"
-  nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
-      >> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
-done
-
-echo "All gateways launched: ${HERMES_PROFILES}"
--- a/ai/hermes/start-hermes.sh
+++ b/ai/hermes/start-hermes.sh
@@ -1,38 +0,0 @@
-#!/bin/bash
-# Multi-profile + default gateway launcher — runs as the CMD via s6-overlay.
-#
-# The image's default ENTRYPOINT ["/init", "/opt/hermes/docker/main-wrapper.sh"]
-# starts the s6 supervision tree, then exec's main-wrapper.sh with the CMD args.
-# main-wrapper.sh sources the venv, drops to the hermes user via s6-setuidgid,
-# and exec's this script.
-#
-# This script:
-#   1. Launches per-profile background gateways (HERMES_PROFILES env var)
-#   2. Starts the default gateway in foreground (keeps the container alive)
-#
-# Replaces the old approach of chaining bash -> tini -g -> deprecated entrypoint.sh
-# which bypassed s6-overlay and caused the SIGTERM crash loop.
-
-set -e
-
-HERMES_BIN="/opt/hermes/.venv/bin/hermes"
-
-# --- Multi-profile gateways (background) ---
-if [ -n "${HERMES_PROFILES:-}" ]; then
-    echo "[start-hermes] Launching per-profile gateways: ${HERMES_PROFILES}"
-    IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
-    for profile in "${PROFILES[@]}"; do
-        profile="$(echo "${profile}" | xargs)"  # trim whitespace
-        [ -z "${profile}" ] && continue
-        echo "[start-hermes]  -> background gateway for profile '${profile}'"
-        # No gosu/s6-setuidgid needed — we're already running as the hermes user
-        # (main-wrapper.sh drops privileges before exec'ing this script).
-        nohup "${HERMES_BIN}" --profile "${profile}" gateway run \
-            >> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
-    done
-    echo "[start-hermes] All profile gateways launched"
-fi
-
-# --- Default gateway (foreground — keeps container alive) ---
-echo "[start-hermes] Starting default gateway (foreground)"
-exec "${HERMES_BIN}" gateway run
--- a/ai/honcho/Dockerfile
+++ b/ai/honcho/Dockerfile
@@ -28,9 +28,10 @@ ENV PATH=$PNPM_HOME:$PATH
 RUN corepack enable && corepack prepare pnpm@latest --activate

 WORKDIR /app
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y git openssh-client && rm -rf /var/lib/apt/lists/**

-ARG OPENCONCHO_SHA=3b5c3293fc18d768dbe85285264a8d66c896bd81
+ARG OPENCONCHO_SHA=148766312e6a5256f399c64171854f0ff6173b6d
+RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan -p 2222 code.lazyworkhorse.net >> ~/.ssh/known_hosts 2>/dev/null
 RUN --mount=type=ssh git clone --depth 1 ssh://git@code.lazyworkhorse.net:2222/gortium/openconcho.git /app && \
    git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
    git -C /app checkout ${OPENCONCHO_SHA}
--- a/ai/llama-cpp/Dockerfile
+++ b/ai/llama-cpp/Dockerfile
@@ -0,0 +1,32 @@
+# llama-cpp-rocm6/Dockerfile
+# Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
+# Build: docker build -t llama-cpp:rocm-gfx906 .
+# NOTE: Update LLAMACPP_VERSION for bugfixes, but verify ROCm 6.1 compat
+#       by checking if recent releases still support -DGGML_HIP=ON.
+
+FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
+ARG LLAMACPP_VERSION=b9890
+RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
+WORKDIR /build
+ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm
+RUN mkdir build && cd build && \
+    cmake .. -DGGML_HIP=ON -DCMAKE_BUILD_TYPE=Release \
+      -DAMDGPU_TARGETS="gfx906:xnack-" \
+      -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+      -DGGML_CUDA=OFF -DGGML_VULKAN=OFF -DGGML_METAL=OFF \
+      -DBUILD_SHARED_LIBS=OFF && \
+    cmake --build . --target llama-server -- -j $(nproc)
+
+FROM ubuntu:24.04
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates curl libstdc++6 libgomp1 libopenblas0 \
+    libnuma1 libelf1 libdrm2 libdrm-amdgpu1 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
+COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
+COPY --from=builder /build/build/bin/llama-server /usr/local/bin/llama-server
+RUN echo /opt/rocm/lib > /etc/ld.so.conf.d/rocm.conf && ldconfig
+ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 HCC_AMDGPU_TARGET=gfx906 HSA_ENABLE_SDMA=0
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/llama-server"]
Author	SHA1	Message	Date
Thierry Pouplier	3353c6fba1	hermes: fix vpn_net networks syntax (map form) for compose v5; drop dead build ssh key	2026-09-15 17:18:28 -04:00
gortium	d57169ad3d	feat: attach hermes to vpn_net at 172.24.0.5 for desktop remote-gateway access	2026-09-15 15:28:51 -04:00
gortium	48c4c1b232	fix: remove stale COPY line for deleted run-multi-gateways.sh Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details	2026-07-07 22:33:35 -04:00
Thierry Pouplier	53fcd59dff	Merge pull request 'Simplify: use native s6 multi-profile supervision, drop custom scripts' (#58 ) from fix/hermes-entrypoint-simple into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #58	2026-07-08 02:25:01 +00:00
gortium	3f82c9d321	Simplify: drop custom scripts, use native s6 multi-profile supervision Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Remove patch_tts_tool.py (orphaned) - Remove run-multi-gateways.sh (replaced by s6 native profile supervision) - Remove start-hermes.sh (overengineered — the image does this natively) - compose.yml: command: gateway run, drop HERMES_PROFILES env var - Dockerfile: revert start-hermes.sh COPY addition Per-profile gateways are now managed by s6-overlay natively: profiles with desired_state=running in gateway_state.json are auto-started by the s6 reconciler on boot.	2026-07-07 22:21:36 -04:00
Thierry Pouplier	a7e463dcd6	Merge pull request 'fix: s6-overlay entrypoint crash — replace broken bash→tini→entrypoint.sh chain' (#56 ) from fix/hermes-s6-overlay-entrypoint-crash into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #56	2026-07-08 02:04:44 +00:00
Thierry Pouplier	59fc28401e	Merge pull request 'fix/hermes-gosu-honcho-ssh' (#57 ) from fix/hermes-gosu-honcho-ssh into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Reviewed-on: #57	2026-07-08 02:02:50 +00:00
Hermes	8df60c2911	fix: update openconcho SHA (template literal for ReactNode) Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details	2026-07-07 20:52:38 -04:00
Hermes	a79f0610ec	fix: update openconcho SHA (cast metadata.name to string)	2026-07-07 20:50:02 -04:00
Hermes	be757bc683	chore: update openconcho to upstream v0.16.0 (rebase feat/fix-openconcho on upstream/main) - rebased custom commits on upstream v0.16.0 - 125 upstream commits since fork base (e490d91) - includes dashboard, fleet, dark mode, deps consolidation - our TS fixes preserved on top	2026-07-07 20:43:02 -04:00
Hermes	3508ae2481	fix: update openconcho SHA to HEAD of feat/fix-openconcho branch (was force-pushed)	2026-07-07 20:09:16 -04:00
Hermes	eb5176949e	fix: add gosu to hermes SSH keyscan to honcho builder - Install gosu in hermes image so run-multi-gateways.sh can drop privileges when USER hermes is set at the end of the Dockerfile. - Add openssh-client + ssh-keyscan to the openconcho-builder stage so SSH host key verification passes during the first Gitea clone.	2026-07-07 19:48:59 -04:00
Hermes	5db33ddfd2	fix: bump llama.cpp from b9596 to b9890 for slot/stability fixes b9596 (Dec 2024) has known slot deadlock on first request causing container freeze. b9890 includes: - Slot selection consolidation (#24755) - HIP fast-math support (#23862) - Hundreds of stability and memory fixes Compatible with ROCm 6.1 + gfx906 (same build flags).	2026-07-07 16:57:22 -04:00
Thierry Pouplier	2d2787f404	Merge pull request 'fix: add missing USER hermes at end of Dockerfile' (#55 ) from local_changes into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #55	2026-07-07 19:41:28 +00:00
Hermes	dab1ecfdd7	Merge remote-tracking branch 'origin/master' into local_changes Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details # Conflicts: # ai/compose.yml	2026-07-07 15:04:00 -04:00
Thierry Pouplier	e595381173	Merge pull request 'feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support' (#54 ) from feat/hermes43-llamacpp into master Some checks failed Build Hermes agent / build (push) Has been cancelled Details Build ollama (gfx906) / build (push) Has been cancelled Details Reviewed-on: #54	2026-07-07 19:00:03 +00:00
Hermes	1e290410de	Merge branch 'master' into feat/hermes43-llamacpp Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details Conflicts resolved: - hermes env: keep OLLAMA_HOST=ollama-cpu + master's new vars - ollama→ollama-cpu rename: keep our rename over master's ollama	2026-07-07 14:50:59 -04:00
Hermes	80c9906757	fix: rename ollama→ollama-cpu, fix llama-cpp-hermes YAML indentation Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Rename ollama service to ollama-cpu (CPU-only for bge-m3 embeddings) - Fix llama-cpp-hermes indented under networks instead of as top-level service - Update hermes OLLAMA_HOST to point to ollama-cpu Part of PR #54 GPU/ROCm refactor	2026-07-07 14:29:23 -04:00
Hermes	3c92d93366	feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support Some checks failed Build Hermes agent / build (pull_request) Has been cancelled Details Build ollama (gfx906) / build (pull_request) Has been cancelled Details - Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build - Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs - Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings) Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.	2026-06-11 11:41:42 -04:00