Frank
327e78b950
The vault was 155 pages / 31,210 lines, most of it measurement ledgers for payloads that no longer run. A throughput figure for a runtime nobody operates is not a record: AI moves faster than the vault, so the number is wrong before anyone reads it, and a wrong number in a runbook gets believed. Per the new purpose test in `AGENTS.md` → *Documentation Policy*, it is destroyed. Gone (`.AGENTTRASH/20261019-destruction/`, KILL-LIST.txt is the manifest): - the `frank-medium` endpoint and its five era pages, `frank-npu`, FastFlowLM, the ikllama/kingjones/dealign/frank-redo eras, the ling/swift15/freetoken/ubatch campaign pages, qwen3.8 spec-matrix and strix-optimizations, the two "Running Qwen3.6 …" pages; - the whole `Pipeline Parallelism/` folder (no live script passes a pipeline flag) and the multi-device/x4-pair/hybrid/offload experiment pages; - every vLLM page — no vLLM endpoint exists on this fleet; - `LLM/deployment.md` (`Architecture/Deployment Flow.md` is the test-referenced owner) and the external surveys (SGLang, Lemonade, llama.cpp forks/diff, self-hosted app census, the TTS survey) that were obsolete by construction; - `log.md`, 2,380 lines. Git holds the chronology; a causal law belongs to the page that owns the thing it governs, never to a diary. Survivors: 101 pages, 17,542 lines, 0 OKF violations, 0 unresolved links. Eras tables keep the window, payload, runtime, reason and rollback pointer; the rate columns are blanked. The live shapes stay verbatim — those numbers are what the deployer and `models.yml` consume.
83 lines
4.3 KiB
Markdown
83 lines
4.3 KiB
Markdown
---
|
|
type: reference
|
|
description: "The Hermes web dashboard is a browser UI for managing the agent."
|
|
tags:
|
|
- dankclaw
|
|
- hermes
|
|
timestamp: 2026-09-16
|
|
---
|
|
|
|
# Hermes-Dashboard
|
|
|
|
The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See [[Hermes]].
|
|
|
|
**Host:** Dankclaw — **Port:** `9119` (published) — **URL:** `https://hermesadmin.franksdank.cloud` (internal-only; direct Caddy proxy, no guard chain) or `http://192.168.0.143:9119`
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `docker.io/nousresearch/hermes-agent:latest` (same as the gateway) |
|
|
| Command | `hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build` |
|
|
| Port | `9119` (published to the LAN) |
|
|
| Auth | HTTP basic auth (username + scrypt password hash) |
|
|
| Data | bind mount `/home/dank/Containers/hermes/data` → `/data`, shared with the gateway; plus a fresh anonymous volume at `/opt/data` per recreation |
|
|
|
|
## Why a separate container
|
|
|
|
The gateway container runs `hermes gateway run` (the Signal platform). That
|
|
entrypoint does not start the dashboard. The dashboard is a separate process, so
|
|
it runs in its own Quadlet unit
|
|
([`dankclaw/hermes/quadlet/hermes-dashboard.container`](../../dankclaw/hermes/quadlet/hermes-dashboard.container):
|
|
image `localhost/hermes-agent:latest`, `Pull=never`, `Exec=hermes dashboard
|
|
--host 0.0.0.0 --port 9119 --no-open --skip-build`, `Restart=always`
|
|
`RestartSec=5`). All three Hermes containers mount the same `/data` bind mount.
|
|
|
|
Unlike its two siblings — `hermes.container` and `hermes-webui.container` both
|
|
run with `Network=host` — the dashboard is the only Hermes container on a bridge
|
|
network (`Network=dankclaw_default`, subnet `10.89.1.0/24`, gateway `10.89.1.1`).
|
|
That has a functional consequence: from inside its namespace it can dial only
|
|
published ports via the gateway IP, and `host.containers.internal`
|
|
(`169.254.1.2`) is an alias on the *default* `podman` network that this container
|
|
is not attached to, so probes to it time out. It therefore never talks to the
|
|
gateway, the webui, or the CDP daemon over the network — it shares their state
|
|
through the bind mount instead. See [[Container Network Namespaces]].
|
|
|
|
## Authentication
|
|
|
|
The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:
|
|
|
|
- `dashboard.basic_auth.username` and `dashboard.basic_auth.password_hash` live in
|
|
the live `/data/config.yaml` (host path
|
|
`/home/dank/Containers/hermes/data/config.yaml`); the tracked backup at
|
|
`dankclaw/hermes/config.yaml.example` intentionally omits the password hash.
|
|
- The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
|
|
- The hash is generated with `plugins.dashboard_auth.basic.hash_password`.
|
|
|
|
## Access
|
|
|
|
Two paths reach the same process, both gated by the dashboard's own basic-auth
|
|
login — there is no unauthenticated bind:
|
|
|
|
1. **`https://hermesadmin.franksdank.cloud`** — Caddy vhost added 2026-09-02 that
|
|
reverse-proxies `192.168.0.143:9119` directly, with **no** Anubis/Outpost guard
|
|
chain in front of it (exempt-by-construction: the app carries its own complete
|
|
auth). The name deliberately has no public DNS record, so the vhost resolves on
|
|
the LAN only; WAN clients get NXDOMAIN. See [[LAN-DNS]].
|
|
2. **`http://192.168.0.143:9119`** — the raw published port. Still reachable from
|
|
any LAN host (the container binds `0.0.0.0` inside its namespace and publishes
|
|
`9119:9119`), so treat the LAN as a trusted boundary here, not as a gate.
|
|
See [[Container Network Namespaces]] for why this container is on a bridge
|
|
network rather than the host namespace like its two siblings.
|
|
|
|
## Gotchas
|
|
|
|
- The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
|
|
- If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
|
|
- `--skip-build` uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.
|
|
|
|
## See Also
|
|
|
|
- [[Hermes-WebUI]] — the phone-facing API server (Hermex)
|
|
- [[Container Network Namespaces]] — why this container cannot dial the gateway, webui, or CDP daemon
|