feat: add 7zz for CHM documentation extraction

Download static 7-Zip binary at Docker build time for extracting Microsoft Compiled HTML Help (.chm) files. Follows the same pattern as the existing Himalaya CLI installation. 7zz is scraped from 7-zip.org/download.html at build time.

.gitea/workflows/build-hermes.yml

@@ -0,0 +1,31 @@
+name: Build Hermes agent
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'ai/hermes/**'
+      - 'ai/compose.yml'
+  push:
+    branches: [ master ]
+    paths:
+      - 'ai/hermes/**'
+      - 'ai/compose.yml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          git clone -b "${{ github.head_ref || github.ref_name }}" \
+            https://gitea:${{ secrets.GITHUB_TOKEN }}@code.lazyworkhorse.net/gortium/compose.git .
+          git log --oneline -3
+
+      - name: Build hermes image
+        run: |
+          cd ai
+          docker compose build hermes 2>&1
+
+      - name: Verify image
+        run: |
+          docker run --rm ai-hermes /opt/hermes/.venv/bin/python --version 2>&1

.gitea/workflows/build-ollama.yml

@@ -0,0 +1,31 @@
+name: Build ollama (gfx906)
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'ai/ollama/**'
+      - 'ai/compose.yml'
+  push:
+    branches: [ master ]
+    paths:
+      - 'ai/ollama/**'
+      - 'ai/compose.yml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          git clone -b "${{ github.head_ref || github.ref_name }}" \
+            https://gitea:${{ secrets.GITHUB_TOKEN }}@code.lazyworkhorse.net/gortium/compose.git .
+          git log --oneline -3
+
+      - name: Build ollama image
+        run: |
+          cd ai
+          docker compose build ollama --no-cache 2>&1
+
+      - name: Verify version
+        run: |
+          docker run --rm ollama/ollama:rocm-gfx906 ollama --version 2>&1

ai/Dockerfile

@@ -1,116 +0,0 @@
-# 1. On récupère la version la plus récente d'UV
-FROM ghcr.io/astral-sh/uv:latest AS uv_source
-
-# 2. Image de base stable
-FROM debian:stable-slim
-
-# Disable Python stdout buffering to ensure logs are printed immediately
-ENV PYTHONUNBUFFERED=1
-
-# Install system dependencies in one layer, clear APT cache
-# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
-        curl poppler-utils imagemagick \
-        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
-        qemu-user-static binfmt-support qemu-user-binfmt \
-        emacs-nox \
-        libportaudio2 \
-        ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
-
-# Création de l'utilisateur 'hermes' directement avec les bons accès
-RUN useradd -u 10000 -m -d /opt/data hermes
-
-# Copie d'uv (dernière version)
-COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
-
-WORKDIR /opt/hermes
-
-# On donne la propriété du dossier de travail à l'utilisateur hermes
-RUN chown hermes:hermes /opt/hermes
-
-# ---------- Hermes venv ----------
-# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
-USER hermes
-
-# ---------- Source code ----------
-# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
-COPY --chown=hermes:hermes . .
-
-# ---------- Python virtualenv avec Piper TTS ----------
-RUN uv venv && \
-    uv pip install --no-cache-dir piper-tts sounddevice numpy faster-whisper
-
-# ---------- Télécharger la voix Piper Ryan (high quality) ----------
-RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
-    /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import urllib.request
-base = '/opt/hermes/.venv/share/piper/voices'
-url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
-urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
-urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
-PYEOF
- 
-# ---------- Patch atomic writes to preserve file permissions ----------
-# Fixes https://github.com/NousResearch/hermes-agent/issues/14181
-# tempfile.mkstemp() creates files as 0600; os.replace() preserves that mode,
-# so group-readable files silently collapse to owner-private 0600.
-# This affects: skills, sessions, memories, and any file written atomically.
-RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import os
-
-patches = [
-    ("/opt/hermes/tools/skill_manager_tool.py", [
-        ("# Restore existing file mode if present", True),  # already patched
-    ]),
-    ("/opt/hermes/tools/skills_sync.py", [
-        ("# Restore existing file mode if present", True),  # already patched
-    ]),
-]
-
-for fpath, checks in patches:
-    if not os.path.exists(fpath):
-        print(f"SKIP {fpath} (not found)")
-        continue
-    with open(fpath) as f:
-        code = f.read()
-    all_ok = all(marker in code for marker, _ in checks)
-    if all_ok:
-        print(f"OK {fpath} (already patched)")
-        continue
-    print(f"PATCH {fpath}")
-    # _atomic_write_text in skill_manager_tool.py
-    code = code.replace(
-        "        os.replace(temp_path, file_path)",
-        "        if file_path.exists():\n"
-        "            existing_mode = file_path.stat().st_mode\n"
-        "            os.chmod(temp_path, existing_mode)\n"
-        "        os.replace(temp_path, file_path)",
-    )
-    # _write_manifest in skills_sync.py
-    code = code.replace(
-        "            os.replace(tmp_path, MANIFEST_FILE)",
-        "            if MANIFEST_FILE.exists():\n"
-        "                existing_mode = MANIFEST_FILE.stat().st_mode\n"
-        "                os.chmod(tmp_path, existing_mode)\n"
-        "            os.replace(tmp_path, MANIFEST_FILE)",
-    )
-    with open(fpath, 'w') as f:
-        f.write(code)
-    print(f"DONE {fpath}")
-PYEOF
-
-# ---------- Runtime ----------
-ENV HERMES_HOME=/opt/data
-ENV PATH="/opt/data/.local/bin:${PATH}"
-
-VOLUME [ "/opt/data" ]
-
-# Copie du script de réparation des permissions (lancement au démarrage)
-COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
-
-# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
-# fix-permissions.sh chown les répertoires critiques avant de chaîner vers entrypoint.sh
-ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]

ai/compose.yml

@@ -26,8 +26,14 @@ services:
   #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
 
   hermes:
-    build: ./
+    build:
+      context: ./hermes
+      ssh:
+        - default
     container_name: hermes
+    entrypoint: ["/bin/bash", "-c",
+      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
     command: gateway run
@@ -45,6 +51,7 @@ services:
       - HIP_VISIBLE_DEVICES=0,1
       - ROCR_VISIBLE_DEVICES=0,1
       - HSA_ENABLE_SDMA=0
+      - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     devices:
@@ -57,9 +64,11 @@ services:
       - ai_backend
 
   ollama:
-    image: ollama/ollama:latest
+    build:
+      context: ./ollama
+      dockerfile: Dockerfile
+    image: ollama/ollama:rocm-gfx906
     container_name: ollama
-    privileged: true
     tty: true
     restart: always 
     ports:
@@ -77,7 +86,7 @@ services:
       - HSA_ENABLE_SDMA=0 
       - OLLAMA_HOST=0.0.0.0
       - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=0
+      - OLLAMA_FLASH_ATTENTION=1
       - OLLAMA_NUM_PARALLEL=2
     devices:
       # Map the render nodes and KFD for ROCm to work inside the container

ai/fix-permissions.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-# Startup permission fix for the Hermes data volume.
-# Runs as root before the entrypoint drops to the hermes user.
-# Fixes files that were created by root (host agent, cron jobs, etc.)
-# becoming inaccessible to the hermes runtime user.
-set -e
-
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
-
-# Fix ownership on critical writable directories so hermes user can access them
-chown -R hermes:hermes \
-  "$HERMES_HOME/sessions" \
-  "$HERMES_HOME/checkpoints" \
-  "$HERMES_HOME/skills" \
-  "$HERMES_HOME/memories" \
-  "$HERMES_HOME/workspace" \
-  "$HERMES_HOME/pastes" \
-  "$HERMES_HOME/logs" \
-  "$HERMES_HOME/cron" \
-  "$HERMES_HOME/plans" \
-  "$HERMES_HOME/hooks" \
-  "$HERMES_HOME/cache" \
-  2>/dev/null || true
-
-# Also fix the data volume root if it's wrong
-if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
-  chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
-fi
-
-# Now chain to the real entrypoint
-exec /opt/hermes/docker/entrypoint.sh "$@"

ai/hermes/Dockerfile

@@ -0,0 +1,134 @@
+# syntax=docker/dockerfile:1
+# Hermes Agent -- custom fork build
+# Builds on top of official image + overlays our forked source from Gitea.
+# Requires Docker BuildKit. Pass SSH agent for git clone:
+#   docker compose build hermes
+# Or manually:
+#   DOCKER_BUILDKIT=1 docker build --ssh default -t hermes-agent:custom .
+
+# ---------- Base: official Hermes image (system deps, npm, uv, Playwright) ----------
+FROM nousresearch/hermes-agent:latest
+
+# ---------- Overlay our forked source ----------
+# Uses SSH agent forwarding from the build host (no key baked into image).
+# --exclude node_modules/.venv keeps the base image's pre-built layers intact.
+# Only the Python source, web UI source, and config change.
+RUN --mount=type=ssh \
+    mkdir -p /root/.ssh && \
+    ssh-keyscan -p 2222 code.lazyworkhorse.net >> /root/.ssh/known_hosts 2>/dev/null && \
+    cd /tmp && \
+    GIT_SSH_COMMAND='ssh -p 2222 -o StrictHostKeyChecking=no' \
+    git clone --depth 1 --branch main \
+    git@code.lazyworkhorse.net:gortium/hermes-agent.git fork && \
+    rsync -a --delete fork/ /opt/hermes/ \
+      --exclude node_modules \
+      --exclude .venv \
+      --exclude .git && \
+    rm -rf /tmp/fork /root/.ssh/
+
+# ---------- Rebuild web UI ----------
+# Source files changed; node_modules (from base image) reused.
+RUN cd /opt/hermes && npm run build
+
+# ---------- Reinstall Python package (editable) ----------
+# Picks up source changes from our fork.
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir --no-deps -e /opt/hermes
+
+# ---------- Extra system deps ----------
+USER root
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libportaudio2 ca-certificates poppler-utils imagemagick \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
+        texlive-xetex texlive-science \
+        qemu-user-static binfmt-support emacs-nox && \
+    rm -rf /var/lib/apt/lists/*
+
+# ---------- UV ----------
+COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
+
+# ---------- Piper TTS ----------
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir piper-tts sounddevice numpy && \
+    mkdir -p /opt/hermes/.venv/share/piper/voices
+
+RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import urllib.request
+base = '/opt/hermes/.venv/share/piper/voices'
+url = 'https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/ryan/high/en_US-ryan-high.onnx'
+urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
+urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
+PYEOF
+
+# ---------- Install Himalaya email CLI ----------
+RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import urllib.request, tarfile, os, shutil
+url = 'https://github.com/pimalaya/himalaya/releases/download/v1.2.0/himalaya.x86_64-linux.tgz'
+tgz = '/tmp/himalaya.tgz'
+urllib.request.urlretrieve(url, tgz)
+with tarfile.open(tgz) as t:
+    t.extractall('/tmp')
+shutil.move('/tmp/himalaya', '/usr/local/bin/himalaya')
+os.chmod('/usr/local/bin/himalaya', 0o755)
+os.remove(tgz)
+print('himalaya v1.2.0 installed')
+PYEOF
+
+# ---------- Install himalaya-ro wrapper ----------
+COPY --chmod=0755 himalaya-ro.sh /usr/local/bin/himalaya-ro
+
+# ---------- Install 7-Zip for CHM extraction ----------
+RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
+import urllib.request, tarfile, os, shutil, re, subprocess
+
+# Scrape 7-zip.org for latest Linux x64 binary
+url = 'https://7-zip.org/download.html'
+req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
+r = urllib.request.urlopen(req, timeout=15)
+html = r.read().decode()
+
+links = re.findall(r'href="(a/7z[\d]+-linux-x64\.tar\.xz)"', html)
+if not links:
+    raise RuntimeError("Could not find 7z download link")
+
+dl_url = f'https://7-zip.org/{links[0]}'
+print(f'Downloading 7z from {dl_url}...')
+req = urllib.request.Request(dl_url, headers={'User-Agent': 'Mozilla/5.0'})
+r = urllib.request.urlopen(req, timeout=30)
+data = r.read()
+
+with open('/tmp/7z.tar.xz', 'wb') as f:
+    f.write(data)
+
+subprocess.run(['tar', '-xJf', '/tmp/7z.tar.xz', '-C', '/tmp/'], check=True)
+
+for root, dirs, files in os.walk('/tmp'):
+    for f in files:
+        if f == '7zz':
+            src = os.path.join(root, f)
+            shutil.move(src, '/usr/local/bin/7zz')
+            os.chmod('/usr/local/bin/7zz', 0o755)
+            print(f'7zz installed from {src}')
+            break
+
+os.remove('/tmp/7z.tar.xz')
+
+# Verify
+r = subprocess.run(['/usr/local/bin/7zz'], capture_output=True, text=True)
+print(f'7-Zip {r.stdout.strip()[:60]}')
+PYEOF
+
+
+# ---------- Runtime ----------
+USER hermes
+ENV HERMES_HOME=/opt/data
+ENV PATH="/opt/data/.local/bin:${PATH}"
+# Point browser tool to Playwright's Chromium (already in base image)
+ENV CHROME_EXECUTABLE=/opt/hermes/.playwright/chromium/chrome-linux/chrome
+
+# Ensure tools directory and toolsets.py are writable by the hermes runtime user
+# so custom tools can be injected from the persistent volume at startup.
+RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
+
+VOLUME [ "/opt/data" ]

ai/hermes/himalaya-ro.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# himalaya-ro — Read-only wrapper for himalaya
+#
+# Blocks destructive commands and logs audit trail.
+# Pass-through for read-only commands (list, read, search).
+#
+# Usage:  himalaya-ro [options] <command> [args...]
+#
+# Install: place in PATH before the real himalaya, or use
+#          `ln -sf himalaya-ro /usr/local/bin/himalaya`
+# ─────────────────────────────────────────────────────────────
+set -o pipefail
+
+# ── Configuration ───────────────────────────────────────────
+HIMALAYA_BIN="${HIMALAYA_BIN:-/usr/local/bin/himalaya}"
+AUDIT_LOG="${HIMALAYA_AUDIT_LOG:-/var/log/himalaya-audit.log}"
+
+# ── Destructive commands we block ──────────────────────────
+BLOCKED_CMDS=(
+  "message move"
+  "message delete"
+  "message copy"
+  "flag add"
+  "flag remove"
+  "folder create"
+  "folder delete"
+  "folder rename"
+  "template send"
+  "account configure"
+  "account delete"
+)
+
+# ── Determine the subcommand being invoked ─────────────────
+# Strip leading options (--account, --output, etc.) to find the verb
+ARGS=()
+SKIP_NEXT=false
+for arg in "$@"; do
+  if $SKIP_NEXT; then
+    SKIP_NEXT=false
+    continue
+  fi
+  if [[ "$arg" == --* ]]; then
+    case "$arg" in
+      --account|--output|--page|--page-size|--folder|--color|--format)
+        SKIP_NEXT=true ;;
+    esac
+    continue
+  fi
+  ARGS+=("$arg")
+done
+
+# Build subcommand string and check against blocklist
+CMD_STR=""
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  if [ -z "$CMD_STR" ]; then
+    CMD_STR="${ARGS[$i]}"
+  else
+    CMD_STR="$CMD_STR ${ARGS[$i]}"
+  fi
+  for blocked in "${BLOCKED_CMDS[@]}"; do
+    if [[ "$CMD_STR" == "$blocked" ]]; then
+      TS=$(date '+%Y-%m-%d %H:%M:%S')
+      echo "[AUDIT] $TS BLOCKED: himalaya $*" >> "$AUDIT_LOG"
+      echo "ERROR: Command 'himalaya $CMD_STR ...' is blocked by read-only policy." >&2
+      echo "       Audit log: $AUDIT_LOG" >&2
+      exit 100
+    fi
+  done
+done
+
+# ── Allow pass-through ─────────────────────────────────────
+exec "$HIMALAYA_BIN" "$@"

ai/hermes/patch_tts_tool.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
+
+Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
+
+Searches multiple paths for tts_tool.py so it works both at build time
+(in the image venv) and at runtime (on the mounted data volume).
+
+Idempotent: if already patched, does nothing.
+"""
+
+import sys
+import os
+
+# ---------------------------------------------------------------------------
+# Search for all copies of tts_tool.py
+# ---------------------------------------------------------------------------
+CANDIDATE_PATHS = [
+    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
+    "/opt/hermes/tools/tts_tool.py",
+]
+
+found_paths = []
+
+for p in CANDIDATE_PATHS:
+    if os.path.exists(p):
+        found_paths.append(p)
+        print(f"Found tts_tool.py at: {p}")
+
+# Also try to find via Python import
+import subprocess
+try:
+    result = subprocess.run(
+        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
+        capture_output=True, text=True, timeout=5
+    )
+    if result.returncode == 0:
+        p = result.stdout.strip()
+        if os.path.exists(p) and p not in found_paths:
+            found_paths.append(p)
+            print(f"Found tts_tool.py via import at: {p}")
+except Exception:
+    pass
+
+if not found_paths:
+    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
+    print(f"Searched: {CANDIDATE_PATHS}")
+    sys.exit(0)
+
+# ---------------------------------------------------------------------------
+# Old else block: the Edge TTS default fallback to replace
+# ---------------------------------------------------------------------------
+old_else = '''        else:
+            # Default: Edge TTS (free), with NeuTTS as local fallback
+            edge_available = True
+            try:
+                _import_edge_tts()
+            except ImportError:
+                edge_available = False
+
+            if edge_available:
+                logger.info("Generating speech with Edge TTS...")
+                try:
+                    import concurrent.futures
+                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                        pool.submit(
+                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+                        ).result(timeout=60)
+                except RuntimeError:
+                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
+            elif _check_neutts_available():
+                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
+                provider = "neutts"
+                _generate_neutts(text, file_str, tts_config)
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
+                             "or set up NeuTTS for local synthesis."
+                }, ensure_ascii=False)'''
+
+# ---------------------------------------------------------------------------
+# New block: elif provider == "piper" + else: fallback with Piper only
+# ---------------------------------------------------------------------------
+new_block = '''        elif provider == "piper":
+            # Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if not os.path.exists(model_path):
+                return json.dumps({
+                    "success": False,
+                    "error": "Piper TTS voice model not found. "
+                             "Install Piper TTS and download a voice model."
+                }, ensure_ascii=False)
+            logger.info("Generating speech with Piper TTS (local, CPU)...")
+            import subprocess as _sp
+            cmd = [piper_binary, "--model", model_path, "--output-raw"]
+            try:
+                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
+                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                if proc.returncode != 0:
+                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
+                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+            except Exception as e:
+                return json.dumps({
+                    "success": False,
+                    "error": f"Piper TTS failed: {e}"
+                }, ensure_ascii=False)
+
+        else:
+            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if os.path.exists(model_path) and os.path.exists(piper_binary):
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess as _sp
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                try:
+                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
+                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                    if proc.returncode != 0:
+                        raise RuntimeError(stderr.decode()[:200])
+                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                except Exception:
+                    pass
+            else:
+                return json.dumps({
+                    "success": False,
+                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
+                }, ensure_ascii=False)'''
+
+# ---------------------------------------------------------------------------
+# Apply the patch to all copies found
+# ---------------------------------------------------------------------------
+patched_any = False
+
+for tts_path in found_paths:
+    with open(tts_path) as f:
+        code = f.read()
+
+    if 'provider == "piper"' in code:
+        print(f"ALREADY PATCHED: {tts_path}")
+        continue
+
+    if old_else in code:
+        code = code.replace(old_else, new_block, 1)
+        with open(tts_path, 'w') as f:
+            f.write(code)
+        print(f"PATCHED: {tts_path}")
+        patched_any = True
+    else:
+        print(f"SKIP {tts_path}: Edge fallback pattern not found")
+        import re
+        for m in re.finditer(r'        else:\n            # Default:', code):
+            start = max(0, m.start() - 100)
+            end = min(len(code), m.end() + 300)
+            print(f"  Found 'else:/# Default:' at position {m.start()}:")
+            print(f"  {code[start:end]}")
+            print("  ---")
+        # Don't exit with error — if one copy isn't patchable, try the others
+
+if not patched_any:
+    all_patched = all(
+        'provider == "piper"' in open(p).read()
+        for p in found_paths
+    )
+    if all_patched:
+        print("All copies already patched.")
+        sys.exit(0)
+    print("WARNING: Could not patch any copy of tts_tool.py")
+    sys.exit(1)
+
+print("tts_tool.py patched successfully across all copies.")

ai/ollama/Dockerfile

@@ -0,0 +1,106 @@
+# ollama-gfx906/Dockerfile
+#
+# Custom ollama image with ROCm 6.1 + gfx906 (MI50) support.
+# The official ollama/rocm image ships ROCm 7.2 which dropped gfx906.
+# This uses v0.23.2's native CMake build system with AMDGPU_TARGETS including gfx906.
+#
+# Build: docker build -t ollama/ollama:rocm-gfx906 ai/ollama
+
+FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
+
+# Build dependencies (CMake, Ninja, Go)
+ARG CMAKEVERSION=3.31.2
+ARG NINJAVERSION=1.12.1
+ARG GOLANG_VERSION=1.22.0
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    curl git ccache build-essential pkg-config unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install CMake from official binaries
+RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v${CMAKEVERSION}/cmake-${CMAKEVERSION}-linux-x86_64.tar.gz \
+    | tar xz -C /usr/local --strip-components 1
+
+# Install Ninja
+RUN curl -fsSL -o /tmp/ninja.zip \
+    https://github.com/ninja-build/ninja/releases/download/v${NINJAVERSION}/ninja-linux.zip \
+    && unzip /tmp/ninja.zip -d /usr/local/bin && rm /tmp/ninja.zip
+
+# Install Go
+RUN curl -fsSL https://go.dev/dl/go${GOLANG_VERSION}.linux-amd64.tar.gz \
+    | tar xz -C /usr/local
+ENV PATH=/usr/local/go/bin:$PATH
+
+ARG OLLAMA_VERSION=v0.23.2
+RUN git clone --depth 1 --branch ${OLLAMA_VERSION} https://github.com/ollama/ollama.git /build
+WORKDIR /build
+
+# ROCm paths
+ENV HIP_PATH=/opt/rocm
+ENV ROCM_PATH=/opt/rocm
+ENV CMAKE_GENERATOR=Ninja
+ENV LDFLAGS=-s
+
+# Step 1: Build CPU backends with GCC (no ROCm preset)
+# Pre-set CMAKE_HIP_COMPILER="" to prevent check_language(HIP) from
+# finding a HIP compiler (it searches /opt/rocm even without PATH).
+# Remove /opt/rocm from PATH to prevent find_program from finding hipcc.
+RUN mkdir -p build-cpu && \
+    PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+    cmake -B build-cpu -DCMAKE_BUILD_TYPE=Release \
+      -DCMAKE_HIP_COMPILER="" \
+      -DCMAKE_INSTALL_PREFIX=/build/dist && \
+    cmake --build build-cpu --target ggml-cpu -- -l $(nproc) && \
+    cmake --install build-cpu --component CPU --strip && \
+    echo "=== CPU install ===" && \
+    (find /build/dist/lib/ollama -type f -o -type l 2>&1 | head -20 || echo "empty")
+
+# Step 2: Build HIP backend with ROCm preset + gfx906 target only
+# The ROCm 6 preset enables HIP language detection (enable_language(HIP))
+# which ensures GPU kernels are properly compiled for gfx906.
+# OLLAMA_RUNNER_DIR=rocm from the preset, so HIP goes to lib/ollama/rocm/
+# Need CMAKE_PREFIX_PATH so find_package(hip) finds hip-config.cmake
+# at /opt/rocm/lib/cmake/hip/hip-config.cmake.
+RUN mkdir -p build-hip && \
+    cmake -B build-hip \
+      --preset 'ROCm 6' \
+      -DAMDGPU_TARGETS="gfx906:xnack-" \
+      -DCMAKE_BUILD_TYPE=Release \
+      -DCMAKE_PREFIX_PATH="/opt/rocm" && \
+    cmake --build build-hip --target ggml-hip -- -l $(nproc) && \
+    cmake --install build-hip --component HIP --strip && \
+    echo "=== HIP install ===" && \
+    find /build/dist/lib/ollama -type f -o -type l | head -20
+
+# Step 3: Build Go binary (GCC for CGo linking)
+ENV CGO_ENABLED=1
+RUN go build -trimpath -ldflags="-X=github.com/ollama/ollama/version.Version=${OLLAMA_VERSION}" -o /build/dist/ollama .
+
+# ---------- Runtime image ----------
+FROM ubuntu:24.04
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates curl libstdc++6 libgomp1 libvulkan1 libopenblas0 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy ROCm 6.1 runtime libraries
+# These are needed at runtime by ggml-hip via LD_LIBRARY_PATH
+COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
+COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
+
+# Copy ollama binary + all backends (CPU + HIP)
+# CPU install:  /build/dist/lib/ollama/libggml-*.so
+# HIP install:  /build/dist/lib/ollama/rocm/libggml-hip.so
+COPY --from=builder /build/dist/ollama /usr/bin/ollama
+COPY --from=builder /build/dist/lib/ollama/ /usr/lib/ollama/
+
+RUN ldconfig
+
+ENV LD_LIBRARY_PATH=/opt/rocm/lib:/usr/lib/ollama/rocm:/usr/lib/ollama
+ENV HSA_OVERRIDE_GFX_VERSION=9.0.6
+ENV HCC_AMDGPU_TARGET=gfx906
+ENV HSA_ENABLE_SDMA=0
+
+EXPOSE 11434
+ENTRYPOINT ["/bin/ollama"]
+CMD ["serve"]

ai/patch_tts_tool.py

@@ -1,96 +0,0 @@
-#!/usr/bin/env python3
-"""Patch Hermes TTS tool: remove Edge TTS, replace with Piper as default/fallback."""
-import sys
-
-tts_path = '/opt/hermes/tools/tts_tool.py'
-
-with open(tts_path) as f:
-    code = f.read()
-
-# Replace the Edge fallback with Piper fallback
-old_edge = '''        else:
-            # Default: Edge TTS (free), with NeuTTS as local fallback
-            edge_available = True
-            try:
-                _import_edge_tts()
-            except ImportError:
-                edge_available = False
-
-            if edge_available:
-                logger.info("Generating speech with Edge TTS...")
-                try:
-                    import concurrent.futures
-                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-                        pool.submit(
-                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-                        ).result(timeout=60)
-                except RuntimeError:
-                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-            elif _check_neutts_available():
-                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
-                provider = "neutts"
-                _generate_neutts(text, file_str, tts_config)
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
-                             "or set up NeuTTS for local synthesis."
-                }, ensure_ascii=False)'''
-
-new_piper = '''        else:
-            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_available = False
-            try:
-                piper_binary = "/opt/hermes/.venv/bin/piper"
-                piper_config = tts_config.get("piper", {})
-                voice = piper_config.get("voice", "en_US-lessac-medium")
-                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-                model_path = os.path.join(model_dir, f"{voice}.onnx")
-                if os.path.exists(model_path):
-                    piper_available = True
-            except Exception:
-                pass
-
-            if piper_available:
-                logger.info("Generating speech with Piper TTS (local, CPU)...")
-                import subprocess
-                piper_binary = "/opt/hermes/.venv/bin/piper"
-                piper_config = tts_config.get("piper", {})
-                voice = piper_config.get("voice", "en_US-lessac-medium")
-                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-                model_path = os.path.join(model_dir, f"{voice}.onnx")
-                cmd = [piper_binary, "--model", model_path, "--output-raw"]
-                proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                if proc.returncode != 0:
-                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
-                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-                logger.info("Piper TTS audio saved: %s", file_str)
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "No TTS provider available. Install Piper TTS (pip install piper-tts) "
-                             "and download a voice model."
-                }, ensure_ascii=False)'''
-
-if old_edge in code:
-    code = code.replace(old_edge, new_piper)
-    print("Edge fallback replaced with Piper")
-else:
-    if 'Default: Piper TTS' in code:
-        print("Piper fallback already present")
-    else:
-        print("ERROR: Could not find Edge fallback in tts_tool.py")
-        # Debug output
-        import re
-        for m in re.finditer(r'        else:\n            # Default:', code):
-            start = max(0, m.start() - 100)
-            end = min(len(code), m.end() + 200)
-            print(f"Found else/default at position {m.start()}:")
-            print(code[start:end])
-        sys.exit(1)
-
-with open(tts_path, 'w') as f:
-    f.write(code)
-print("tts_tool.py patched successfully")

versioncontrol/compose.yml

@@ -7,8 +7,14 @@ services:
       - USER_UID=1000
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
+      - GITEA__actions__ENABLED=true
+      - GITEA__actions__DEFAULT_ACTIONS_URL=off
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
+      # Enable Gitea Actions (act_runner required on host)
+      - GITEA__actions__ENABLED=true
+      # Don't fetch actions from GitHub (offline mode + local only)
+      - GITEA__actions__DEFAULT_ACTIONS_URL=off
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks:
@@ -40,6 +46,22 @@ services:
       # Internal Routing
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
+  act_runner:
+    image: gitea/act_runner:latest
+    container_name: act_runner
+    environment:
+      - GITEA_INSTANCE_URL=https://code.lazyworkhorse.net
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
+      - GITEA_RUNNER_NAME=ai-host-runner
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://catthehacker/ubuntu:full-22.04,nixos-builder:docker://nixos/nix
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - vc_net
+    restart: always
+    depends_on:
+      - gitea
+
 networks:
   vc_net:
     external: true

vpn/Dockerfile

@@ -1,16 +1,9 @@
 # Custom wg-easy with iptables-nft (nftables-backed iptables)
 # Fixes crash-loop when host kernel lacks legacy iptable_nat module.
-FROM weejewel/wg-easy:latest
+FROM ghcr.io/wg-easy/wg-easy:latest
 
-# Alpine's iptables-nft provides iptables that uses nftables kernel API
+# The upstream image registers only iptables-legacy with update-alternatives.
-# instead of the legacy iptable_nat module. This works on kernels
+# iptables-nft binary exists but isn't registered as an alternative key.
-# where only nftables netfilter modules are available.
+# Override the alternatives-managed symlinks directly.
-RUN apk add --no-cache iptables-nft
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
-
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables
-# Ensure iptables-nft takes priority over legacy iptables
-RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
-    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
-    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
-    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
-    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
-    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore

vpn/compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 services:
   wireguard:
     build:
-      context: ./vpn
+      context: .
       dockerfile: Dockerfile
     image: wg-easy-iptables-nft:latest
     container_name: wireguard