FilesExpand file tree

main

/

docker-compose.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

76 lines (75 loc) · 3.37 KB

main

/

docker-compose.yml

Copy path

Top

File metadata and controls

• Code
• Blame

76 lines (75 loc) · 3.37 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

#

# docker-compose.yml for Hermes Agent

#

# Usage:

# HERMES_UID=$(id -u) HERMES_GID=$(id -g) docker compose up -d

#

# Set HERMES_UID / HERMES_GID to the host user that owns ~/.hermes so

# files created inside the container stay readable/writable on the host.

# The s6-overlay stage2 hook remaps the internal `hermes` user to these

# values via usermod/groupmod; each supervised service then drops to that

# user via `s6-setuidgid`.

#

# Security notes:

# - The dashboard service binds to 127.0.0.1 by default. It stores API

# keys; exposing it on LAN without auth is unsafe. If you want remote

# access, use an SSH tunnel or put it behind a reverse proxy that

# adds authentication — do NOT pass --insecure --host 0.0.0.0.

# - If you override entrypoint, keep `/init` as the first command in

# the chain (or let docker use the image's default ENTRYPOINT,

# which is `["/init", "/opt/hermes/docker/main-wrapper.sh"]`).

# `/init` is s6-overlay's PID 1 — it runs the cont-init.d scripts

# (chown, profile reconcile, dashboard toggle) and sets up the

# supervision tree before any service starts. Bypassing it skips

# all of that setup and the gateway will not work correctly.

# - The gateway's API server is off unless you uncomment API_SERVER_KEY

# and API_SERVER_HOST. See docs/user-guide/api-server.md before doing

# this on an internet-facing host.

#

services:

gateway:

build: .

image: hermes-agent

container_name: hermes

restart: unless-stopped

network_mode: host

volumes:

- ~/.hermes:/opt/data

environment:

- HERMES_UID=${HERMES_UID:-10000}

- HERMES_GID=${HERMES_GID:-10000}

# To expose the OpenAI-compatible API server beyond localhost,

# uncomment BOTH lines (API_SERVER_KEY is mandatory for auth):

# - API_SERVER_HOST=0.0.0.0

# - API_SERVER_KEY=${API_SERVER_KEY}

# Microsoft Teams — uncomment and fill in to enable Teams gateway.

# Register your bot at https://dev.botframework.com/ to get these values.

# - TEAMS_CLIENT_ID=${TEAMS_CLIENT_ID}

# - TEAMS_CLIENT_SECRET=${TEAMS_CLIENT_SECRET}

# - TEAMS_TENANT_ID=${TEAMS_TENANT_ID}

# - TEAMS_ALLOWED_USERS=${TEAMS_ALLOWED_USERS}

# - TEAMS_PORT=${TEAMS_PORT:-3978}

# Google Chat — uncomment and fill in to enable the Google Chat gateway.

# See website/docs/user-guide/messaging/google_chat.md for the full setup.

# The SA JSON path must point to a file mounted into the container —

# add a volume entry above (e.g. ``- ~/.hermes/google-chat-sa.json:/secrets/google-chat-sa.json:ro``)

# then set GOOGLE_CHAT_SERVICE_ACCOUNT_JSON to that mount path.

# - GOOGLE_CHAT_PROJECT_ID=${GOOGLE_CHAT_PROJECT_ID}

# - GOOGLE_CHAT_SUBSCRIPTION_NAME=${GOOGLE_CHAT_SUBSCRIPTION_NAME}

# - GOOGLE_CHAT_SERVICE_ACCOUNT_JSON=${GOOGLE_CHAT_SERVICE_ACCOUNT_JSON}

# - GOOGLE_CHAT_ALLOWED_USERS=${GOOGLE_CHAT_ALLOWED_USERS}

command: ["gateway", "run"]

dashboard:

image: hermes-agent

container_name: hermes-dashboard

restart: unless-stopped

network_mode: host

depends_on:

- gateway

volumes:

- ~/.hermes:/opt/data

environment:

- HERMES_UID=${HERMES_UID:-10000}

- HERMES_GID=${HERMES_GID:-10000}

# Localhost-only. For remote access, tunnel via `ssh -L 9119:localhost:9119`.

command: ["dashboard", "--host", "127.0.0.1", "--no-open"]