Updates the compose submodule to commit 3f82c9d on branch
fix/hermes-entrypoint-simple, which drops all custom entrypoint
scripts and uses the image's native s6-overlay profile supervision.
The five profiles (ashley, claire, finn, matt, paul) auto-start
on boot via the s6 reconciler reading their gateway_state.json.
Updates the compose submodule to commit f4dd57f on branch
fix/hermes-s6-overlay-entrypoint-crash, which:
- Removes the broken entrypoint override (bash->tini->entrypoint.sh)
- Bakes start-hermes.sh into the image as the new CMD
- Uses the image default ENTRYPOINT (s6-overlay /init)
Fixes the SIGTERM restart loop on the Hermes container.
See compose PR #56 for details.
The compose submodule now points to commit 54e0661 which adds the missing
USER hermes at the end of the Hermes Dockerfile. This ensures all container
processes run as uid 10000 instead of root, fixing the privilege leak where
background subprocesses escaped the gosu drop and created root-owned files
in ExoKortex that broke Syncthing sync.
Updates the assets/compose submodule to point to the fix/vpn-iptables-nft-upstream
branch which contains:
- Switch FROM weejewel/wg-easy:latest (Alpine 3.11, stale 4yr) to
ghcr.io/wg-easy/wg-easy:latest (actively maintained, Alpine krypton)
- Use update-alternatives instead of raw ln -sf to flip iptables
from legacy to nftables backend
- Fix compose build context: ./vpn -> . (Dockerfile is at same level)
