fix: also clear API_SERVER_KEY for profile gateways

Line 1521 in gateway/config.py: if api_server_enabled or api_server_key: The compose.yml sets API_SERVER_KEY=hermes_local_key, which was enough to enable the API server even with API_SERVER_ENABLED=false.
fix: use env to force API_SERVER_ENABLED=false in multi-gateway launcher
2026-05-22 13:53:53 -04:00 · 2026-05-22 13:52:05 -04:00 · 2026-05-22 13:34:12 -04:00 · 2026-05-22 13:22:58 -04:00 · 2026-05-22 13:04:43 -04:00 · 2026-05-22 13:04:08 -04:00
3 changed files with 41 additions and 2 deletions
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -35,6 +35,8 @@ services:
      "bash /opt/data/hermes-tools/install.sh && bash /opt/data/hermes-tools/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
      "hermes-entrypoint"]
    restart: always
+    # Gateway run enables the internal API server on port 8642
+    command: gateway run
    environment:
      - OLLAMA_HOST=http://ollama:11434
      - HERMES_DASHBOARD=1
@@ -61,8 +63,6 @@ services:
      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
-      # Persist Python venv across container recreation (Matrix bridge deps, etc.)
-      - /mnt/HoardingCow_docker_data/Hermes/venv:/opt/hermes/.venv
    devices:
      - /dev/kfd:/dev/kfd
      - /dev/dri:/dev/dri
--- a/ai/hermes/Dockerfile
+++ b/ai/hermes/Dockerfile
@@ -34,6 +34,7 @@ USER root
 RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        libportaudio2 ca-certificates poppler-utils imagemagick \
+        libolm-dev \
        texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
        texlive-xetex texlive-science \
        qemu-user-static binfmt-support emacs-nox && \
@@ -42,6 +43,12 @@ RUN apt-get update && \
 # ---------- UV ----------
 COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/

+# ---------- Matrix bridge + extra pip deps ----------
+# Previously installed inline at container startup and persisted via volume mount.
+# Now baked into the image so the fragile venv volume mount can be removed.
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir 'mautrix[encryption]' openai
+
 # ---------- Piper TTS ----------
 RUN . /opt/hermes/.venv/bin/activate && \
    uv pip install --no-cache-dir piper-tts sounddevice numpy && \
--- a/run-multi-gateways.sh
+++ b/run-multi-gateways.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+# Multi-gateway launcher for HERMES_PROFILES env var.
+# Reads comma-separated profile names, spawns one gateway per profile.
+# Designed to run before the main entrypoint — gateways run in background.
+set -e
+
+if [ -z "${HERMES_PROFILES}" ]; then
+  echo "HERMES_PROFILES not set — skipping multi-gateway launch"
+  exit 0
+fi
+
+# Source venv to make 'hermes' available (entrypoint.sh sources it later,
+# but we need it NOW for the background gateways)
+HERMES_BIN="/opt/hermes/.venv/bin/hermes"
+if [ ! -x "$HERMES_BIN" ]; then
+  echo "ERROR: hermes binary not found at $HERMES_BIN"
+  exit 1
+fi
+
+mkdir -p /opt/data/logs
+
+IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
+for profile in "${PROFILES[@]}"; do
+  profile="$(echo "${profile}" | xargs)"  # trim whitespace
+  [ -z "${profile}" ] && continue
+
+  echo "Starting gateway for profile: ${profile}"
+  nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
+      >> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
+done
+
+echo "All gateways launched: ${HERMES_PROFILES}"
Author	SHA1	Message	Date
Hermes	e8075fb71b	fix: also clear API_SERVER_KEY for profile gateways Line 1521 in gateway/config.py: if api_server_enabled or api_server_key: The compose.yml sets API_SERVER_KEY=hermes_local_key, which was enough to enable the API server even with API_SERVER_ENABLED=false.	2026-05-22 13:53:53 -04:00
Hermes	645d519030	fix: use env to force API_SERVER_ENABLED=false in multi-gateway launcher Shell prefix didn't work with nohup+gosu chain - Docker compose env var API_SERVER_ENABLED=true leaked through. Using 'env' command guarantees the override is in the child process env.	2026-05-22 13:52:05 -04:00
Hermes	146add2a64	fix: use full hermes path and gosu in multi-gateway launcher - Use /opt/hermes/.venv/bin/hermes (full path) — not on PATH before entrypoint.sh sources the venv - Wrap with gosu hermes to avoid root guard in gateway run - Add error check if hermes binary doesn't exist	2026-05-22 13:34:12 -04:00
Hermes	45a224eb7f	fix: add missing command: gateway run to hermes service Without this, is empty and entrypoint.sh runs bare 'hermes' which defaults to interactive chat mode. With a non-TTY stdin this exits immediately with prompt_toolkit's 'Input is not a terminal' warning, causing a container restart loop. The profile gateways (run-multi-gateways.sh) were unaffected because the script passes 'gateway run' explicitly.	2026-05-22 13:22:58 -04:00
Hermes	bce336c4fd	feat: bake Matrix bridge deps into Docker image instead of volume mount - Add libolm-dev system dep (required by mautrix[encryption]) - Add mautrix[encryption] + openai pip packages to build - These were previously installed inline at container startup and persisted via the fragile venv volume mount (now removed)	2026-05-22 13:04:43 -04:00
Hermes	e4117cd3d5	fix: remove venv volume mount conflicting with entrypoint.sh The volume mount at /mnt/HoardingCow_docker_data/Hermes/venv overrides the container's built .venv with an empty or stale host directory, causing entrypoint.sh line 62 to fail on 'source .venv/bin/activate' (set -e). The Docker image already builds a complete venv — no need to persist it.	2026-05-22 13:04:08 -04:00