From 5e8d669a2cfcb1b189ab9af35aa29cd38da9a270 Mon Sep 17 00:00:00 2001 From: Thierry Pouplier Date: Fri, 18 Sep 2026 15:54:23 -0400 Subject: [PATCH 1/2] hermes: add supervised dashboard-cathou service (:9120, own identity). Second s6 service reusing the main dashboard machinery, mounted read-only; env injected in compose. Runs the command directly to dodge the with-contenv env reset that would collapse it to the main service identity. --- ai/compose.yml | 3 +++ ai/s6/dashboard-cathou/dependencies.d/base | 1 + ai/s6/dashboard-cathou/finish | 4 ++++ ai/s6/dashboard-cathou/run | 17 +++++++++++++++++ ai/s6/dashboard-cathou/type | 1 + 5 files changed, 26 insertions(+) create mode 100644 ai/s6/dashboard-cathou/dependencies.d/base create mode 100644 ai/s6/dashboard-cathou/finish create mode 100644 ai/s6/dashboard-cathou/run create mode 100644 ai/s6/dashboard-cathou/type diff --git a/ai/compose.yml b/ai/compose.yml index fa4c744..647a105 100755 --- a/ai/compose.yml +++ b/ai/compose.yml @@ -23,9 +23,12 @@ services: - ROCR_VISIBLE_DEVICES=0,1 - HSA_ENABLE_SDMA=0 - TZ=America/Montreal + - CATHOU_SERVE_PASSWORD=${CATHOU_SERVE_PASSWORD:?must be set} + - CATHOU_SERVE_SECRET=${CATHOU_SERVE_SECRET:?must be set} volumes: - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex + - ./s6/dashboard-cathou:/etc/s6-overlay/s6-rc.d/dashboard-cathou:ro devices: - /dev/kfd:/dev/kfd - /dev/dri:/dev/dri diff --git a/ai/s6/dashboard-cathou/dependencies.d/base b/ai/s6/dashboard-cathou/dependencies.d/base new file mode 100644 index 0000000..8681f8b --- /dev/null +++ b/ai/s6/dashboard-cathou/dependencies.d/base @@ -0,0 +1 @@ +base \ No newline at end of file diff --git a/ai/s6/dashboard-cathou/finish b/ai/s6/dashboard-cathou/finish new file mode 100644 index 0000000..1729eeb --- /dev/null +++ b/ai/s6/dashboard-cathou/finish @@ -0,0 +1,4 @@ +#!/command/with-contenv sh +# Always restart on exit (exit != 125). Crash-loop with a bad auth +# config is the intended fail-closed signal. +exit 0 \ No newline at end of file diff --git a/ai/s6/dashboard-cathou/run b/ai/s6/dashboard-cathou/run new file mode 100644 index 0000000..c2c9427 --- /dev/null +++ b/ai/s6/dashboard-cathou/run @@ -0,0 +1,17 @@ +#!/command/with-contenv sh +# Personal dashboard serve (:9120) for cathou — same machinery as the +# main dashboard service, but runs the command directly so its OWN +# with-contenv shebang can't wipe our env (a second with-contenv reset +# would drop the port + auth variables). Supervised by s6: restarts on crash. +export HERMES_DASHBOARD_PORT=9120 +export HERMES_DASHBOARD_BASIC_AUTH_USERNAME=cathou +export HERMES_DASHBOARD_BASIC_AUTH_PASSWORD="${CATHOU_SERVE_PASSWORD:-}" +export HERMES_DASHBOARD_BASIC_AUTH_SECRET="${CATHOU_SERVE_SECRET:-}" +export HOME=/opt/data +cd /opt/data +# shellcheck disable=SC1091 +. /opt/hermes/.venv/bin/activate +# Fail-closed: missing password => provider won't register => serve fails +# => s6 crash-loop surfaces it, never a silent unauthenticated bind. +[ "$(id -u)" = 0 ] || exec hermes dashboard --host 0.0.0.0 --port 9120 --no-open +exec s6-setuidgid hermes hermes dashboard --host 0.0.0.0 --port 9120 --no-open \ No newline at end of file diff --git a/ai/s6/dashboard-cathou/type b/ai/s6/dashboard-cathou/type new file mode 100644 index 0000000..1780f9f --- /dev/null +++ b/ai/s6/dashboard-cathou/type @@ -0,0 +1 @@ +longrun \ No newline at end of file -- 2.49.1 From 888523079f1ae9dab868430450d6939833a0e59a Mon Sep 17 00:00:00 2001 From: Thierry Pouplier Date: Fri, 18 Sep 2026 16:23:28 -0400 Subject: [PATCH 2/2] hermes: route all dashboard/honcho secrets through age-backed env (no hardcoded values for public repo); add main-dash auth env --- ai/compose.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ai/compose.yml b/ai/compose.yml index 647a105..d3cc549 100755 --- a/ai/compose.yml +++ b/ai/compose.yml @@ -25,6 +25,9 @@ services: - TZ=America/Montreal - CATHOU_SERVE_PASSWORD=${CATHOU_SERVE_PASSWORD:?must be set} - CATHOU_SERVE_SECRET=${CATHOU_SERVE_SECRET:?must be set} + - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=thierry + - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=${HERMES_DASHBOARD_BASIC_AUTH_PASSWORD:?must be set} + - HERMES_DASHBOARD_BASIC_AUTH_SECRET=${HERMES_DASHBOARD_BASIC_AUTH_SECRET:?must be set} volumes: - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex @@ -141,7 +144,7 @@ services: container_name: honcho restart: unless-stopped environment: - - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho + - DB_CONNECTION_URI=postgresql+psycopg://honcho:${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set}@honcho-db:5432/honcho - CACHE_URL=redis://honcho-redis:6379/0 - CACHE_ENABLED=true - EMBEDDING_VECTOR_DIMENSIONS=1024 @@ -182,7 +185,7 @@ services: environment: - POSTGRES_DB=honcho - POSTGRES_USER=honcho - - POSTGRES_PASSWORD=honcho_pass + - POSTGRES_PASSWORD=${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set} - PGDATA=/var/lib/postgresql/data/pgdata volumes: - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data -- 2.49.1