From 34918bf30907f6e4adba2ee350076ad92da46b89 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Thu, 20 Aug 2026 22:54:35 -0700
Subject: [PATCH] hermes: add web dashboard service (basic-auth, LAN port 9119)

Add a hermes-dashboard compose service that runs 'hermes dashboard' on
0.0.0.0:9119 with HTTP basic auth. The username + scrypt password hash
live in the git-ignored /home/dank/hermes-data config (plaintext never
stored). A separate container from the Signal gateway, since the gateway
entrypoint does not start the dashboard. Both share the data volume and
are boot-persistent. Docs page + index link added (docs-first contract).
---
 dankclaw/compose.yaml             | 18 +++++++++++++++
 docs/Dankclaw/Hermes-Dashboard.md | 37 +++++++++++++++++++++++++++++++
 docs/index.md                     |  1 +
 3 files changed, 56 insertions(+)
 create mode 100644 docs/Dankclaw/Hermes-Dashboard.md

diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 048e757..24f6985 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -89,6 +89,24 @@ services:
     # SSE), not the :8090 web dashboard, so there is no HTTP endpoint to probe.
     # The container's running state + the daemon's SSE connection are the signal.
 
+  # --- Hermes web dashboard (management UI: config, API keys, sessions) -----
+  # A separate process from the Signal gateway (the gateway entrypoint does not
+  # start the dashboard). Bound to the LAN with basic auth: the username + a
+  # scrypt password_hash live in the git-ignored /home/dank/hermes-data config.
+  # Port 9119 is published so a browser on the LAN can reach it.
+  hermes-dashboard:
+    image: docker.io/nousresearch/hermes-agent:latest
+    container_name: hermes-dashboard
+    restart: unless-stopped
+    entrypoint: ["bash", "-c", "hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build"]
+    environment:
+      HERMES_DATA_DIR: /data
+      HERMES_HOME: /data
+    ports:
+      - "9119:9119"
+    volumes:
+      - /home/dank/hermes-data:/data
+
   # --- Git hosting (migrated from /opt/gitea) ------------------------------
   postgres:
     image: docker.io/library/postgres:16-alpine
diff --git a/docs/Dankclaw/Hermes-Dashboard.md b/docs/Dankclaw/Hermes-Dashboard.md
new file mode 100644
index 0000000..27d90c7
--- /dev/null
+++ b/docs/Dankclaw/Hermes-Dashboard.md
@@ -0,0 +1,37 @@
+# Hermes-Dashboard
+
+The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See [[Hermes]].
+
+**Host:** Dankclaw — **Port:** `9119` — **URL:** `http://192.168.0.143:9119`
+
+## Facts
+
+| Item | Value |
+|------|-------|
+| Image | `docker.io/nousresearch/hermes-agent:latest` (same as the gateway) |
+| Command | `hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build` |
+| Port | `9119` (published to the LAN) |
+| Auth | HTTP basic auth (username + scrypt password hash) |
+| Data | shares `/home/dank/hermes-data` with the gateway |
+
+## Why a separate container
+
+The gateway container runs `hermes gateway run` (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process. So it runs in its own compose service (`hermes-dashboard`). Both services mount the same data volume. Both restart at boot (`restart: unless-stopped`).
+
+## Authentication
+
+The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:
+
+- `dashboard.basic_auth.username` and `dashboard.basic_auth.password_hash` live in the git-ignored `/home/dank/hermes-data/config.yaml`.
+- The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
+- The hash is generated with `plugins.dashboard_auth.basic.hash_password`.
+
+## Access
+
+Open `http://192.168.0.143:9119` in a browser on the LAN. Log in with the configured username and password.
+
+## Gotchas
+
+- The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
+- If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
+- `--skip-build` uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.
diff --git a/docs/index.md b/docs/index.md
index 2c6cafe..bda0835 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -38,6 +38,7 @@ This repository tracks the container stacks for both hosts. Git is the single so
 - [[ComfyUI]] — node-based AI image generation (CPU)
 - [[OpenWebUI]] — chat UI for local LLMs
 - [[Hermes]] — the Nous Research agent
+- [[Hermes-Dashboard]] — the Hermes web management UI (config, keys, sessions)
 - [[Gitea]] — Git hosting (migrated)
 - [[Postgres]] — Gitea database backend