hermes: fix vpn_net networks syntax (map form) for compose v5; drop dead build ssh key

Reviewed-on: #58

ai/compose.yml

@@ -1,113 +1,90 @@
 services:
-
   hermes:
     build:
       context: ./hermes
-      ssh:
-        - default
     container_name: hermes
-    entrypoint: ["/bin/bash", "-c",
-      "bash /usr/local/bin/run-multi-gateways.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
-      "hermes-entrypoint"]
     restart: always
-    # Gateway run enables the internal API server on port 8642
     command: gateway run
     environment:
-      - HERMES_UID=10000
+    - HERMES_UID=10000
-      - HERMES_GID=10000
+    - HERMES_GID=10000
-      - OLLAMA_HOST=http://ollama-cpu:11434
+    - OLLAMA_HOST=http://ollama-cpu:11434
-      - HERMES_DASHBOARD=1
+    - HERMES_DASHBOARD=1
-      # Multi-profile: comma-separated list of profiles to run as gateways.
+    - API_SERVER_ENABLED=true
-      # The entrypoint reads this and starts one gateway per profile.
+    - API_SERVER_PORT=8642
-      # Add profiles here when they exist on disk (e.g. default,researcher,writer)
+    - API_SERVER_HOST=0.0.0.0
-      - HERMES_PROFILES=ashley,claire,finn,matt,paul
+    - API_SERVER_KEY=hermes_local_key
-      - API_SERVER_ENABLED=true
+    - GATEWAY_ALLOW_ALL_USERS=true
-      - API_SERVER_PORT=8642
+    - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-      - API_SERVER_HOST=0.0.0.0
+    - OPENCODE_API_KEY=${OPENCODE_API_KEY}
-      - API_SERVER_KEY=hermes_local_key
+    - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - GATEWAY_ALLOW_ALL_USERS=true
+    - HCC_AMDGPU_TARGET=gfx906
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+    - HIP_VISIBLE_DEVICES=0,1
-      - OPENCODE_API_KEY=${OPENCODE_API_KEY}
+    - ROCR_VISIBLE_DEVICES=0,1
-      # ROCm for GPU-accelerated faster-whisper STT
+    - HSA_ENABLE_SDMA=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+    - TZ=America/Montreal
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0
-      - TZ=America/Montreal
     volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
     devices:
-      - /dev/kfd:/dev/kfd
+    - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
+    - /dev/dri:/dev/dri
     group_add:
-      - "303"
+    - '303'
-      - "26"
+    - '26'
     networks:
-      - ai_backend
+      ai_backend: null
-      - ai_net
+      ai_net: null
+      vpn_net:
+        ipv4_address: 172.24.0.5
     depends_on:
-      - honcho
+    - honcho
     labels:
-      - "traefik.enable=true"
+    - traefik.enable=true
-      - "traefik.docker.network=ai_net"
+    - traefik.docker.network=ai_net
-
+    - traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)
-      # Router for HTTP + redirection to HTTPS
+    - traefik.http.routers.hermes-web-http.entrypoints=web
-      - "traefik.http.routers.hermes-web-http.rule=Host(`hermes.lazyworkhorse.net`)"
+    - traefik.http.routers.hermes-web-http.middlewares=redirect-to-https
-      - "traefik.http.routers.hermes-web-http.entrypoints=web"
+    - traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)
-      - "traefik.http.routers.hermes-web-http.middlewares=redirect-to-https"
+    - traefik.http.routers.hermes-web-https.entrypoints=websecure
-
+    - traefik.http.routers.hermes-web-https.tls=true
-      # Router for HTTPS with TLS — protected by Authelia
+    - traefik.http.routers.hermes-web-https.tls.certresolver=njalla
-      - "traefik.http.routers.hermes-web-https.rule=Host(`hermes.lazyworkhorse.net`)"
+    - traefik.http.routers.hermes-web-https.middlewares=hermes-auth
-      - "traefik.http.routers.hermes-web-https.entrypoints=websecure"
+    - traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/
-      - "traefik.http.routers.hermes-web-https.tls=true"
+    - traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true
-      - "traefik.http.routers.hermes-web-https.tls.certresolver=njalla"
+    - traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups
-      - "traefik.http.routers.hermes-web-https.middlewares=hermes-auth"
+    - traefik.http.services.hermes-web.loadbalancer.server.port=9119
-
-      # Authelia forwardAuth
-      - "traefik.http.middlewares.hermes-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.trustforwardheader=true"
-      - "traefik.http.middlewares.hermes-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
-
-      # Service Loadbalancer (dashboard port 9119)
-      - "traefik.http.services.hermes-web.loadbalancer.server.port=9119"
-
   syncthing:
     image: syncthing/syncthing:latest
     container_name: syncthing
     hostname: syncthing
     restart: always
     ports:
-      - "8384:8384"
+    - 8384:8384
-      - "22000:22000"
+    - 22000:22000
-      - "21027:21027/udp"
+    - 21027:21027/udp
     environment:
-      - TZ=America/Montreal
+    - TZ=America/Montreal
-      - PUID=10000
+    - PUID=10000
-      - PGID=10000
+    - PGID=10000
     volumes:
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
+    - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/ExoKortex
     networks:
-      - ai_backend
+    - ai_backend
-      - ai_net
+    - ai_net
     labels:
-      - "traefik.enable=true"
+    - traefik.enable=true
-      - "traefik.docker.network=ai_net"
+    - traefik.docker.network=ai_net
-
+    - traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+    - traefik.http.routers.syncthing-http.entrypoints=web
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
+    - traefik.http.routers.syncthing-http.middlewares=redirect-to-https
-      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+    - traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)
-
+    - traefik.http.routers.syncthing-https.entrypoints=websecure
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+    - traefik.http.routers.syncthing-https.tls=true
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+    - traefik.http.routers.syncthing-https.tls.certresolver=njalla
-      - "traefik.http.routers.syncthing-https.tls=true"
+    - traefik.http.routers.syncthing-https.middlewares=hermes-auth
-      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+    - traefik.http.services.syncthing.loadbalancer.server.port=8384
-      - "traefik.http.routers.syncthing-https.middlewares=hermes-auth"
-
-      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
-
   ollama-cpu:
     build:
       context: ./ollama
@@ -115,126 +92,110 @@ services:
     image: ollama/ollama:rocm-gfx906
     container_name: ollama-cpu
     tty: true
-    restart: always 
+    restart: always
     ports:
-      - "127.0.0.1:11434:11434"
+    - 127.0.0.1:11434:11434
     networks:
-      - ai_backend
+    - ai_backend
     volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
     environment:
-      - OLLAMA_VULKAN=0
+    - OLLAMA_VULKAN=0
-      - OLLAMA_HOST=0.0.0.0
+    - OLLAMA_HOST=0.0.0.0
-
   llama-cpp-hermes:
     image: llama-cpp:rocm-gfx906
     container_name: llama-cpp-hermes
     restart: unless-stopped
     networks:
-      - ai_backend
+    - ai_backend
     ports:
-      - "127.0.0.1:8300:8080"
+    - 127.0.0.1:8300:8080
     ipc: host
     devices:
-      - /dev/kfd:/dev/kfd
+    - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
+    - /dev/dri:/dev/dri
     group_add:
-      - "303"
+    - '303'
-      - "26"
+    - '26'
     environment:
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+    - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HSA_ENABLE_SDMA=0
+    - HSA_ENABLE_SDMA=0
-      - HIP_VISIBLE_DEVICES=0,1
+    - HIP_VISIBLE_DEVICES=0,1
-      - LLAMA_CACHE=/models
+    - LLAMA_CACHE=/models
     volumes:
-      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+    - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
+    - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-    command: >
+    command: '-m /model.gguf --host 0.0.0.0 --port 8080 --gpu-layers 99 --ctx-size
-      -m /model.gguf
+      163840 -ctk f16 -ctv f16 --flash-attn on --split-mode layer --no-mmap --n-predict
-      --host 0.0.0.0
+      -1
-      --port 8080
-      --gpu-layers 99
-      --ctx-size 163840
-      -ctk f16 -ctv f16
-      --flash-attn on
-      --split-mode layer
-      --no-mmap
-      --n-predict -1
 
-  # --- Honcho + OpenConcho combiné: API + Web UI nginx/FastAPI ---
+      '
   honcho:
     build:
       context: ./honcho
       ssh:
-        - default
+      - default
     container_name: honcho
     restart: unless-stopped
     environment:
-      - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
+    - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
-      - CACHE_URL=redis://honcho-redis:6379/0
+    - CACHE_URL=redis://honcho-redis:6379/0
-      - CACHE_ENABLED=true
+    - CACHE_ENABLED=true
-      - EMBEDDING_VECTOR_DIMENSIONS=1024
+    - EMBEDDING_VECTOR_DIMENSIONS=1024
-      - AUTH_USE_AUTH=true
+    - AUTH_USE_AUTH=true
-      - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
+    - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
-      # Needed by deriver/dream to make LLM calls (api_key_env = "HONCHO_OPENAI_API_KEY" in config.toml)
+    - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
-      - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
     volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
+    - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
-      - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
+    - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
     networks:
-      - ai_backend
+    - ai_backend
-      - ai_net
+    - ai_net
     labels:
-      - "traefik.enable=true"
+    - traefik.enable=true
-      - "traefik.docker.network=ai_net"
+    - traefik.docker.network=ai_net
-
+    - traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)
-      # Router for HTTP + redirect to HTTPS
+    - traefik.http.routers.honcho-http.entrypoints=web
-      - "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
+    - traefik.http.routers.honcho-http.middlewares=redirect-to-https
-      - "traefik.http.routers.honcho-http.entrypoints=web"
+    - traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)
-      - "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
+    - traefik.http.routers.honcho-https.entrypoints=websecure
-
+    - traefik.http.routers.honcho-https.tls=true
-      # Router for HTTPS with TLS — protected by Authelia
+    - traefik.http.routers.honcho-https.tls.certresolver=njalla
-      - "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
+    - traefik.http.routers.honcho-https.middlewares=hermes-auth
-      - "traefik.http.routers.honcho-https.entrypoints=websecure"
+    - traefik.http.services.honcho.loadbalancer.server.port=80
-      - "traefik.http.routers.honcho-https.tls=true"
-      - "traefik.http.routers.honcho-https.tls.certresolver=njalla"
-      - "traefik.http.routers.honcho-https.middlewares=hermes-auth"
-
-      # Service Loadbalancer (nginx port)
-      - "traefik.http.services.honcho.loadbalancer.server.port=80"
     depends_on:
-      - honcho-db
+    - honcho-db
-      - honcho-redis
+    - honcho-redis
-
   honcho-db:
     image: pgvector/pgvector:pg15
     container_name: honcho-db
     restart: unless-stopped
     ports:
-      - "127.0.0.1:5432:5432"
+    - 127.0.0.1:5432:5432
-    command: ["postgres", "-c", "max_connections=200"]
+    command:
+    - postgres
+    - -c
+    - max_connections=200
     environment:
-      - POSTGRES_DB=honcho
+    - POSTGRES_DB=honcho
-      - POSTGRES_USER=honcho
+    - POSTGRES_USER=honcho
-      - POSTGRES_PASSWORD=honcho_pass
+    - POSTGRES_PASSWORD=honcho_pass
-      - PGDATA=/var/lib/postgresql/data/pgdata
+    - PGDATA=/var/lib/postgresql/data/pgdata
     volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
+    - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
-      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
     networks:
-      - ai_backend
+    - ai_backend
-
   honcho-redis:
     image: redis:8
     container_name: honcho-redis
     restart: unless-stopped
     ports:
-      - "127.0.0.1:6379:6379"
+    - 127.0.0.1:6379:6379
     volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
+    - /mnt/HoardingCow_docker_data/Honcho/redis:/data
     networks:
-      - ai_backend
+    - ai_backend
-
 networks:
   ai_net:
     driver: bridge
@@ -242,193 +203,10 @@ networks:
   ai_backend:
     driver: bridge
     name: ai_backend
-
+  vpn_net:
+    external: true
+    name: vpn_net
 volumes:
   honcho_data:
     driver: bridge
     name: honcho_data
-    
-  # vllm:
-  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
-  #   container_name: vllm
-  #   # Required for multi-GPU communication (NCCL)
-  #   ipc: host 
-  #   init: true
-  #   shm_size: '2g' 
-  #   networks:
-  #     - ai_backend
-  #   ports:
-  #     - "8300:8000"
-  #   devices:
-  #     - "/dev/kfd:/dev/kfd"
-  #     - "/dev/dri:/dev/dri"
-  #   group_add:
-  #     - "303"
-  #     - "26"
-  #   environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
-  #     HSA_ENABLE_SDMA: 0
-  #     HIP_VISIBLE_DEVICES: 0,1
-  #     NCCL_P2P_DISABLE: 1
-  #     VLLM_WORKER_MULTIPROC_METHOD: spawn
-  #     VLLM_USE_TRITON_FLASH_ATTN: 0
-  #     VLLM_USE_ROCM_CUSTOM_PAGED_ATTN: 0
-  #     VLLM_ATTENTION_BACKEND: ROPE_NAIVE
-  #     VLLM_SKIP_WARMUP: 1
-  #     VLLM_USE_V1: 0
-  #     HF_TOKEN: ${HF_TOKEN}
-  #   command: >
-  #     vllm serve "mistralai/Devstral-Small-2-24B-Instruct-2512" 
-  #     --tensor-parallel-size 2
-  #     --max-model-len 8192
-  #     --gpu-memory-utilization 0.90
-  #     --tokenizer_mode mistral
-  #     --config_format auto
-  #     --load-format auto
-  #     --enforce-eager
-  #     --disable-custom-all-reduce
-  #     --trust-remote-code
-  #     --task generate
-  #     --block-size 16
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
-  #   restart: unless-stopped
-
-  # webui:
-  #   image: ghcr.io/open-webui/open-webui:main
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
-  #   restart: always
-  #   environment:
-  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-http.entrypoints=web"
-  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
-
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
-  #     - "traefik.http.routers.webui-https.tls=true"
-  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
-
-  # n8n:
-  #   image: n8nio/n8n:latest
-  #   container_name: n8n
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_net
-  #   environment:
-  #     - N8N_HOST=n8n.lazyworkhorse.net
-  #     - N8N_PORT=5678
-  #     - N8N_PROTOCOL=https
-  #     - NODE_ENV=production
-  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
-  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
-  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
-  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
-  #     - N8N_NATIVE_PYTHON_RUNNER=true
-  #     - N8N_PYTHON_ALLOW_STDLIB=uuid,re,os,json
-  #     - N8N_PYTHON_ALLOW_EXTERNAL=requests,pandas
-  #     - NODE_FUNCTION_ALLOW_EXTERNAL=uuid,requests
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/n8n:/home/node/.n8n
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.n8n-http.entrypoints=web"
-  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
-
-  #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
-  #     - "traefik.http.routers.n8n-https.tls=true"
-  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
-
-  #     # Service Loadbalancer (n8n default port)
-  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
-
-  # openclaw:
-  #   image: coollabsio/openclaw:latest
-  #   container_name: openclaw
-  #   restart: unless-stopped
-  #   expose:
-  #     - "8080"  # WebUI
-  #     - "18789" # Gateway/WebSocket
-  #     - "8788"  # Nextcloud Webhook
-  #   networks:
-  #     - ai_net
-  #     - ai_backend
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
-  #     - /home/gortium/infra:/data/workspace/infra
-  #   environment:
-  #     - TZ=America/Toronto
-  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-  #     # Point to the sidecar browser
-  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
-  #     - BROWSER_EVALUATE_ENABLED=true
-  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
-  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
-  #   labels:
-  #     - "traefik.enable=true"
-
-  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
-  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
-
-  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
-  #     - "traefik.http.routers.openclaw-https.priority=50"
-  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
-  #     - "traefik.http.routers.openclaw-https.tls=true"
-  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
-  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
-  #   depends_on:
-  #     - openclaw-browser
-
-  # openclaw-browser:
-  #   image: ghcr.io/browserless/chromium:latest
-  #   restart: always
-  #   expose:
-  #     - "3000"
-  #   environment:
-  #     - MAX_CONCURRENT_SESSIONS=10
-  #     - CONNECTION_TIMEOUT=300000
-  #     - PREBOOT_CHROME=true
-  #     - DEMO_MODE=false
-  #   networks:
-  #     ai_backend:
-  #       aliases:
-  #         - browser
-
-  # openclaw-ssh:
-  #   image: linuxserver/openssh-server:latest
-  #   container_name: openclaw-ssh
-  #   environment:
-  #     - PUID=1000
-  #     - PGID=1000
-  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
-  #     - SUDO_ACCESS=false
-  #     - PASSWORD_ACCESS=false
-  #   volumes:
-  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
-  #     - /home/gortium/infra:/data/workspace/infra:ro
-  #   restart: unless-stopped
-  #   networks:
-  #     - ai_backend
-  #   labels:
-  #     - "traefik.enable=true"
-  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
-  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
-  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
-  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"

ai/hermes/Dockerfile

@@ -13,6 +13,7 @@ FROM nousresearch/hermes-agent:latest
 USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        gosu \
         libportaudio2 ca-certificates poppler-utils imagemagick \
         libolm-dev \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended \
@@ -58,10 +59,6 @@ os.remove(tgz)
 print('himalaya v1.2.0 installed')
 PYEOF
 
-# ---------- Install multi-gateway launcher ----------
-# Launches one gateway process per profile (HERMES_PROFILES env var)
-COPY --chmod=0755 run-multi-gateways.sh /usr/local/bin/run-multi-gateways.sh
-
 # ---------- Runtime ----------
 USER hermes
 ENV HERMES_HOME=/opt/data

ai/hermes/patch_tts_tool.py

@@ -1,181 +0,0 @@
-#!/usr/bin/env python3
-"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
-
-Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
-
-Searches multiple paths for tts_tool.py so it works both at build time
-(in the image venv) and at runtime (on the mounted data volume).
-
-Idempotent: if already patched, does nothing.
-"""
-
-import sys
-import os
-
-# ---------------------------------------------------------------------------
-# Search for all copies of tts_tool.py
-# ---------------------------------------------------------------------------
-CANDIDATE_PATHS = [
-    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
-    "/opt/hermes/tools/tts_tool.py",
-]
-
-found_paths = []
-
-for p in CANDIDATE_PATHS:
-    if os.path.exists(p):
-        found_paths.append(p)
-        print(f"Found tts_tool.py at: {p}")
-
-# Also try to find via Python import
-import subprocess
-try:
-    result = subprocess.run(
-        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
-        capture_output=True, text=True, timeout=5
-    )
-    if result.returncode == 0:
-        p = result.stdout.strip()
-        if os.path.exists(p) and p not in found_paths:
-            found_paths.append(p)
-            print(f"Found tts_tool.py via import at: {p}")
-except Exception:
-    pass
-
-if not found_paths:
-    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
-    print(f"Searched: {CANDIDATE_PATHS}")
-    sys.exit(0)
-
-# ---------------------------------------------------------------------------
-# Old else block: the Edge TTS default fallback to replace
-# ---------------------------------------------------------------------------
-old_else = '''        else:
-            # Default: Edge TTS (free), with NeuTTS as local fallback
-            edge_available = True
-            try:
-                _import_edge_tts()
-            except ImportError:
-                edge_available = False
-
-            if edge_available:
-                logger.info("Generating speech with Edge TTS...")
-                try:
-                    import concurrent.futures
-                    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-                        pool.submit(
-                            lambda: asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-                        ).result(timeout=60)
-                except RuntimeError:
-                    asyncio.run(_generate_edge_tts(text, file_str, tts_config))
-            elif _check_neutts_available():
-                logger.info("Edge TTS not available, falling back to NeuTTS (local)...")
-                provider = "neutts"
-                _generate_neutts(text, file_str, tts_config)
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "No TTS provider available. Install edge-tts (pip install edge-tts) "
-                             "or set up NeuTTS for local synthesis."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# New block: elif provider == "piper" + else: fallback with Piper only
-# ---------------------------------------------------------------------------
-new_block = '''        elif provider == "piper":
-            # Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if not os.path.exists(model_path):
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS voice model not found. "
-                             "Install Piper TTS and download a voice model."
-                }, ensure_ascii=False)
-            logger.info("Generating speech with Piper TTS (local, CPU)...")
-            import subprocess as _sp
-            cmd = [piper_binary, "--model", model_path, "--output-raw"]
-            try:
-                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                if proc.returncode != 0:
-                    raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
-                ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-            except Exception as e:
-                return json.dumps({
-                    "success": False,
-                    "error": f"Piper TTS failed: {e}"
-                }, ensure_ascii=False)
-
-        else:
-            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_binary = "/opt/hermes/.venv/bin/piper"
-            piper_config = tts_config.get("piper", {})
-            voice = piper_config.get("voice", "en_US-lessac-medium")
-            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-            model_path = os.path.join(model_dir, f"{voice}.onnx")
-            if os.path.exists(model_path) and os.path.exists(piper_binary):
-                logger.info("Generating speech with Piper TTS (local, CPU)...")
-                import subprocess as _sp
-                cmd = [piper_binary, "--model", model_path, "--output-raw"]
-                try:
-                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
-                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
-                    if proc.returncode != 0:
-                        raise RuntimeError(stderr.decode()[:200])
-                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-                except Exception:
-                    pass
-            else:
-                return json.dumps({
-                    "success": False,
-                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
-                }, ensure_ascii=False)'''
-
-# ---------------------------------------------------------------------------
-# Apply the patch to all copies found
-# ---------------------------------------------------------------------------
-patched_any = False
-
-for tts_path in found_paths:
-    with open(tts_path) as f:
-        code = f.read()
-
-    if 'provider == "piper"' in code:
-        print(f"ALREADY PATCHED: {tts_path}")
-        continue
-
-    if old_else in code:
-        code = code.replace(old_else, new_block, 1)
-        with open(tts_path, 'w') as f:
-            f.write(code)
-        print(f"PATCHED: {tts_path}")
-        patched_any = True
-    else:
-        print(f"SKIP {tts_path}: Edge fallback pattern not found")
-        import re
-        for m in re.finditer(r'        else:\n            # Default:', code):
-            start = max(0, m.start() - 100)
-            end = min(len(code), m.end() + 300)
-            print(f"  Found 'else:/# Default:' at position {m.start()}:")
-            print(f"  {code[start:end]}")
-            print("  ---")
-        # Don't exit with error — if one copy isn't patchable, try the others
-
-if not patched_any:
-    all_patched = all(
-        'provider == "piper"' in open(p).read()
-        for p in found_paths
-    )
-    if all_patched:
-        print("All copies already patched.")
-        sys.exit(0)
-    print("WARNING: Could not patch any copy of tts_tool.py")
-    sys.exit(1)
-
-print("tts_tool.py patched successfully across all copies.")

ai/hermes/run-multi-gateways.sh

@@ -1,32 +0,0 @@
-#!/bin/bash
-# Multi-gateway launcher for HERMES_PROFILES env var.
-# Reads comma-separated profile names, spawns one gateway per profile.
-# Designed to run before the main entrypoint — gateways run in background.
-set -e
-
-if [ -z "${HERMES_PROFILES}" ]; then
-  echo "HERMES_PROFILES not set — skipping multi-gateway launch"
-  exit 0
-fi
-
-# Source venv to make 'hermes' available (entrypoint.sh sources it later,
-# but we need it NOW for the background gateways)
-HERMES_BIN="/opt/hermes/.venv/bin/hermes"
-if [ ! -x "$HERMES_BIN" ]; then
-  echo "ERROR: hermes binary not found at $HERMES_BIN"
-  exit 1
-fi
-
-mkdir -p /opt/data/logs
-
-IFS=',' read -ra PROFILES <<< "${HERMES_PROFILES}"
-for profile in "${PROFILES[@]}"; do
-  profile="$(echo "${profile}" | xargs)"  # trim whitespace
-  [ -z "${profile}" ] && continue
-
-  echo "Starting gateway for profile: ${profile}"
-  nohup env API_SERVER_ENABLED=false API_SERVER_KEY= gosu hermes "$HERMES_BIN" --profile "${profile}" gateway run \
-      >> "/opt/data/logs/gateway-${profile}.log" 2>&1 &
-done
-
-echo "All gateways launched: ${HERMES_PROFILES}"

ai/honcho/Dockerfile

@@ -28,9 +28,10 @@ ENV PATH=$PNPM_HOME:$PATH
 RUN corepack enable && corepack prepare pnpm@latest --activate
 
 WORKDIR /app
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y git openssh-client && rm -rf /var/lib/apt/lists/**
 
-ARG OPENCONCHO_SHA=3b5c3293fc18d768dbe85285264a8d66c896bd81
+ARG OPENCONCHO_SHA=148766312e6a5256f399c64171854f0ff6173b6d
+RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan -p 2222 code.lazyworkhorse.net >> ~/.ssh/known_hosts 2>/dev/null
 RUN --mount=type=ssh git clone --depth 1 ssh://git@code.lazyworkhorse.net:2222/gortium/openconcho.git /app && \
     git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
     git -C /app checkout ${OPENCONCHO_SHA}

ai/llama-cpp/Dockerfile

@@ -1,10 +1,12 @@
 # llama-cpp-rocm6/Dockerfile
 # Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
 # Build: docker build -t llama-cpp:rocm-gfx906 .
+# NOTE: Update LLAMACPP_VERSION for bugfixes, but verify ROCm 6.1 compat
+#       by checking if recent releases still support -DGGML_HIP=ON.
 
 FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
-ARG LLAMACPP_VERSION=b9596
+ARG LLAMACPP_VERSION=b9890
 RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
 WORKDIR /build
 ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm