From 44438979b351b3ac3349fcb5d124063112c49eb2 Mon Sep 17 00:00:00 2001 From: Frank Date: Mon, 31 Aug 2026 13:13:07 -0700 Subject: [PATCH] feat(hermes-webui): publish webui on LAN interface instead of loopback LAN clients now connect directly to 192.168.0.143:8787 (password-gated via HERMES_WEBUI_PASSWORD); the SSH tunnel via port 22 remains the sole off-network ingress. Recreation also re-reads the rotated password from dankclaw/.env via the [Container] EnvironmentFile. --- dankclaw/hermes/quadlet/hermes-webui.container | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dankclaw/hermes/quadlet/hermes-webui.container b/dankclaw/hermes/quadlet/hermes-webui.container index b2e1ad0..096b213 100644 --- a/dankclaw/hermes/quadlet/hermes-webui.container +++ b/dankclaw/hermes/quadlet/hermes-webui.container @@ -7,9 +7,10 @@ # foreground mode: bootstrap.py creates .venv inside the mounted checkout, # installs WebUI + agent deps, then execs server.py as a single foreground # process. It reads HERMES_HOME=/data, so it drives the SAME agent state -# (memory, skills, sessions) as the gateway container. Loopback-only publish: -# the SSH tunnel (phone -> Dankclaw:22) is the sole ingress. The password -# gates Hermex logins and lives in the host .env (git-ignored). +# (memory, skills, sessions) as the gateway container. Published on the LAN +# interface only (192.168.0.143:8787): password-gated (HERMES_WEBUI_PASSWORD +# in the host .env, git-ignored), so LAN clients connect directly and the +# SSH tunnel (phone -> Dankclaw:22) remains the sole off-network ingress. [Unit] Description=Hermes webui (Hermex) container @@ -29,7 +30,7 @@ Environment=HERMES_WEBUI_PASSWORD=${HERMES_WEBUI_PASSWORD} Environment=HERMES_WEBUI_SKIP_ONBOARDING=1 Volume=/home/dank/hermes-data:/data Volume=/home/dank/hermes-webui:/webui -PublishPort=127.0.0.1:8787:8787 +PublishPort=192.168.0.143:8787:8787 Exec=python3 /webui/bootstrap.py --foreground # JSON exec form on purpose: this quadlet generator joins a bare HealthCmd # into ONE argv element with \x20 escapes and then shell-executes it — the