Frank
03d44d3308
ComfyUI had failed 9,146 times and had been down ~7 hours when this was found:
its container was created 2026-09-15 14:12, BEFORE the GPU declarations were
added to the compose service, and `restart: unless-stopped` kept restarting
that stale container — no /dev/kfd, no /dev/dri, no keep-groups — so it died
every time on `RuntimeError: No HIP GPUs are available`. Its "unit" was a
hand-written ~/.config/systemd/user/comfyui.service that shelled out to
`podman compose up -d`, which is not repo-tracked state and collides by name
with the Quadlet the generator produces.
- dankclaw/comfyui/quadlet/comfyui.container: image comfyui-rocm:gfx1151
(built from Containerfile.comfyui), /dev/kfd + /dev/dri, keep-groups,
the four comfyui-data volumes, loopback-only publish (an unguarded service
is internal-only here; the homepage card probes 127.0.0.1:8188), Restart=
always, WantedBy=default.target.
- the compose service is deleted — one owner per container name.
- deploy_comfyui builds the image, installs the unit, retires the compose-era
unit into ~/.AGENTTRASH, removes the stale container so the unit's own can
take the name, and waits on :8188.
- the healthcheck is a file, because the podman 5.x v1 generator splits
HealthCmd on spaces and an inline `python3 -c "..."` becomes a quoting
puzzle that fails silently.
The comfyui seam now reads the unit instead of compose for devices, command and
groups (and resolves the Containerfile from the deployer's declaration, not
from a directory listing).
148 lines
7.6 KiB
YAML
148 lines
7.6 KiB
YAML
# Dankclaw stack — AI, search, development & observability services.
|
|
# Deploy: cd /home/dank/serverAppConfigs && podman-compose -f dankclaw/compose.yaml up -d
|
|
# See ../docs/Dankclaw/ and ../docs/Infrastructure/ for service documentation.
|
|
|
|
services:
|
|
# --- SearXNG stack (gluetun + searxng + valkey) --------------------------
|
|
# These three services are now boot-persistent Quadlet units, not compose
|
|
# services. They live in searxng/quadlet/ and install to
|
|
# ~/.config/containers/systemd/ on the host. searxng reuses gluetun's netns
|
|
# (Network=gluetun.container) so its traffic exits the WireGuard tunnel.
|
|
# Deploy with: scripts/deploy-searxng-quadlet.sh dankclaw
|
|
# See ../docs/Dankclaw/SearXNG.md, Gluetun.md, Valkey.md.
|
|
|
|
# --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
|
|
# ComfyUI is a boot-persistent Quadlet unit since 2026-09-16:
|
|
# comfyui/quadlet/comfyui.container, installed by deploy-remote.sh. It left
|
|
# compose after the container it had started went stale — created before the
|
|
# GPU declarations existed, then restarted by `restart: unless-stopped`
|
|
# without /dev/kfd or /dev/dri until it had failed 9,146 times on
|
|
# "No HIP GPUs are available". Built from Containerfile.comfyui (AMD's
|
|
# gfx1151 base), models and data under /home/dank/comfyui-data.
|
|
# See ../docs/Dankclaw/ComfyUI.md.
|
|
|
|
# --- Chat UI (open-webui) ------------------------------------------------
|
|
# Now a boot-persistent Quadlet unit (quadlet, slirp4netns, port 3005), not
|
|
# a compose service. See open-webui/quadlet/open-webui.container and
|
|
# ../docs/Dankclaw/OpenWebUI.md.
|
|
|
|
hermes:
|
|
image: docker.io/nousresearch/hermes-agent:latest
|
|
container_name: hermes
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
# The image's default s6 entrypoint runs the interactive TUI, which exits
|
|
# without a TTY and crash-loops the container. Override it to run the
|
|
# headless gateway (the documented Docker mode). The gateway drops to the
|
|
# unprivileged hermes user (uid 10000), so the data dir must be writable by it.
|
|
entrypoint: ["bash", "-c", "hermes gateway run --force -v"]
|
|
environment:
|
|
HERMES_DATA_DIR: /data
|
|
# Point hermes's config/.env at the mounted data dir (persistent).
|
|
HERMES_HOME: /data
|
|
# Signal adapter -> the signal-cli daemon, a HOST process listening on
|
|
# :8080. The service runs with network_mode: host below, so it dials
|
|
# loopback directly; from a bridge network only DNAT'd published ports
|
|
# accept connections to the host LAN IP, and un-forwarded ports refuse
|
|
# instantly (verified live 2026-08-30).
|
|
SIGNAL_HTTP_URL: "http://127.0.0.1:8080"
|
|
SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}"
|
|
SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}"
|
|
ports:
|
|
- "8090:8090"
|
|
volumes:
|
|
- /home/dank/hermes-data:/data
|
|
# No healthcheck: 'hermes gateway run' starts the messaging gateway (Signal
|
|
# SSE), not the :8090 web dashboard, so there is no HTTP endpoint to probe.
|
|
# The container's running state + the daemon's SSE connection are the signal.
|
|
|
|
# --- Hermes web dashboard (management UI: config, API keys, sessions) -----
|
|
# A separate process from the Signal gateway (the gateway entrypoint does not
|
|
# start the dashboard). Bound to the LAN with basic auth: the username + a
|
|
# scrypt password_hash live in the git-ignored /home/dank/hermes-data config.
|
|
# Port 9119 is published so a browser on the LAN can reach it.
|
|
hermes-dashboard:
|
|
image: docker.io/nousresearch/hermes-agent:latest
|
|
container_name: hermes-dashboard
|
|
restart: unless-stopped
|
|
entrypoint: ["bash", "-c", "hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build"]
|
|
environment:
|
|
HERMES_DATA_DIR: /data
|
|
HERMES_HOME: /data
|
|
ports:
|
|
- "9119:9119"
|
|
volumes:
|
|
- /home/dank/hermes-data:/data
|
|
|
|
# --- Hermes web UI (Hermex server; phone-facing API for the agent) --------
|
|
# Runs the open-source hermes-webui (github.com/nesquena/hermes-webui) in
|
|
# foreground mode: bootstrap.py creates .venv inside the mounted checkout,
|
|
# installs WebUI + agent deps, then execs server.py as a single foreground
|
|
# process. It reads HERMES_HOME=/data, so it drives the SAME agent state
|
|
# (memory, skills, sessions) as the gateway container.
|
|
# Loopback-only publish: the SSH tunnel (phone -> Dankclaw:22) is the sole
|
|
# ingress. The password gates Hermex logins and lives in the host .env.
|
|
hermes-webui:
|
|
image: docker.io/nousresearch/hermes-agent:latest
|
|
container_name: hermes-webui
|
|
restart: unless-stopped
|
|
entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"]
|
|
environment:
|
|
HERMES_HOME: /data
|
|
# Container-internal bind: 0.0.0.0 so Podman's port forwarder (which
|
|
# dials the container's bridge IP) can reach it. The *host-side*
|
|
# publish below stays on 127.0.0.1, so loopback-only ingress holds.
|
|
HERMES_WEBUI_HOST: 0.0.0.0
|
|
HERMES_WEBUI_PORT: "8787"
|
|
HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}"
|
|
# Headless host: never show the first-run wizard (a profile already
|
|
# exists in /data from the gateway).
|
|
HERMES_WEBUI_SKIP_ONBOARDING: "1"
|
|
ports:
|
|
- "127.0.0.1:8787:8787"
|
|
volumes:
|
|
- /home/dank/hermes-data:/data
|
|
# rw on purpose: bootstrap.py creates /webui/.venv in the repo root.
|
|
- /home/dank/hermes-webui:/webui
|
|
healthcheck:
|
|
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/health')"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
# First boot pip-installs WebUI + agent deps into a fresh venv.
|
|
start_period: 600s
|
|
|
|
# --- Git hosting (Gitea) -------------------------------------------------
|
|
# Now boot-persistent Quadlet units (private bridge network, DNS enabled),
|
|
# not compose services. See gitea/quadlet/ and ../docs/Dankclaw/Gitea.md.
|
|
|
|
# --- Observability -------------------------------------------------------
|
|
# Now boot-persistent Quadlet units, not compose services: prometheus,
|
|
# grafana, loki, alloy and node-exporter install from
|
|
# dankclaw/observability/quadlet/ and are dispatched by deploy_observability
|
|
# in scripts/deploy-remote.sh. They left compose on 2026-09-11, after a host
|
|
# reboot proved that compose-only containers do not come back on their own —
|
|
# the same gap that had already cost the fleet Caddy and Pi-hole.
|
|
#
|
|
# The three HTTP UIs publish on 127.0.0.1 only. Off-host access is through
|
|
# the guarded franksdank.cloud vhosts (Caddy reaches these containers by
|
|
# name over this network) and the host's own homepage status timer probes
|
|
# them over loopback. See
|
|
# serverAppConfigs-docs/Infrastructure/Observability.md.
|
|
|
|
# --- Authentik (SSO / OIDC provider) -------------------------------------
|
|
# Now boot-persistent Quadlet units, not compose services: authentik-
|
|
# postgres -> authentik-server -> authentik-worker start in dependency order
|
|
# via ~/.config/containers/systemd/*.container on the host (repo source:
|
|
# dankclaw/authentik/quadlet/; deploy-remote.sh deploy_authentik installs
|
|
# and starts them). Redis was removed in 2025.10 (sessions/caching moved to
|
|
# PostgreSQL). The Caddyfile's forward_auth vhosts proxy to
|
|
# authentik-server:9000 over the dankclaw_default network (A2A DNS).
|
|
# See ../docs/Infrastructure/Authentik.md.
|
|
|
|
# Caddy (the homelab's single reverse proxy) left compose on 2026-08-26:
|
|
# it is boot-persistent via its Quadlet unit (dankclaw/caddy/quadlet/
|
|
# caddy.container), installed by deploy_caddy in scripts/deploy-remote.sh.
|
|
# The rendered Caddyfile, certs, and config still live under
|
|
# /home/dank/Containers/caddy (rootless-writable).
|