Updates the compose submodule to commit 3f82c9d on branch
fix/hermes-entrypoint-simple, which drops all custom entrypoint
scripts and uses the image's native s6-overlay profile supervision.
The five profiles (ashley, claire, finn, matt, paul) auto-start
on boot via the s6 reconciler reading their gateway_state.json.
The compose submodule now points to commit 54e0661 which adds the missing
USER hermes at the end of the Hermes Dockerfile. This ensures all container
processes run as uid 10000 instead of root, fixing the privilege leak where
background subprocesses escaped the gosu drop and created root-owned files
in ExoKortex that broke Syncthing sync.
Updates the assets/compose submodule to point to the fix/vpn-iptables-nft-upstream
branch which contains:
- Switch FROM weejewel/wg-easy:latest (Alpine 3.11, stale 4yr) to
ghcr.io/wg-easy/wg-easy:latest (actively maintained, Alpine krypton)
- Use update-alternatives instead of raw ln -sf to flip iptables
from legacy to nftables backend
- Fix compose build context: ./vpn -> . (Dockerfile is at same level)
