# Quadlet unit: Hermes web dashboard (rootless, boot-persistent).
#
# Install path on dankclaw: ~/.config/containers/systemd/hermes-dashboard.container
# Unit name: hermes-dashboard.service (container name: hermes-dashboard)
#
# Management UI for the agent (config, API keys, sessions). Published on
# 9119 so Caddy's internal listener can reverse-proxy it; the public vhost
# hermes.franksdank.cloud terminates Authentik auth first, so this port is
# reachable from the LAN but gated twice (Authentik + its own login).
# Shares /data with the gateway: same agent state, two processes.

[Unit]
Description=Hermes web dashboard container

[Container]
ContainerName=hermes-dashboard
Image=localhost/hermes-agent:latest
Pull=never
Network=dankclaw_default
Environment=HERMES_DATA_DIR=/data
Environment=HERMES_HOME=/data
Volume=/home/dank/hermes-data:/data
PublishPort=9119:9119
Exec=bash -c 'hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build'

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target