# Quadlet unit: Hermes web dashboard (rootless, boot-persistent).
#
# Install path on dankclaw: ~/.config/containers/systemd/hermes-dashboard.container
# Unit name: hermes-dashboard.service (container name: hermes-dashboard)
#
# Management UI for the agent (config, API keys, sessions). Published on
# 9119 on network dankclaw_default; Caddy's hermesadmin.franksdank.cloud vhost
# reverse-proxies this port directly (no guard chain) because the dashboard
# enforces its own basic-auth login from /data/config.yaml
# (basic_auth.username + scrypt password_hash), making it exempt-by-construction.
# The name has no public DNS record, so the vhost resolves on the LAN only.
# Shares /data with the gateway: same agent state, two processes.

[Unit]
Description=Hermes web dashboard container

[Container]
ContainerName=hermes-dashboard
Image=localhost/hermes-agent:latest
Pull=never
Network=dankclaw_default
Environment=HERMES_DATA_DIR=/data
Environment=HERMES_HOME=/data
Volume=/home/dank/Containers/hermes/data:/data
PublishPort=9119:9119
Exec=bash -c 'hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build'

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target