dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
14d99a8a174ee1ac201f30bdce955ef695ab7177
serverAppConfigs/dankclaw/compose.yaml
T
Frank 14d99a8a17 comfyui: grant the render group so ROCm can open /dev/kfd 
/dev/kfd and /dev/dri/renderD128 are root:render 0660 on this host. The
container passed the device nodes but only joined group video(44), so torch's
HIP init failed with 'No HIP GPUs are available' and main.py never bound
:8188 — every proxy hop to the app returned 502. Group membership is a
create-time property, so this deploy recreates the container.
2026-08-30 18:12:00 -07:00

267 lines
11 KiB
YAML
Raw Blame History

# Dankclaw stack — AI, search, development & observability services.
# Deploy: cd /home/dank/serverAppConfigs && podman-compose -f dankclaw/compose.yaml up -d
# See ../docs/Dankclaw/ and ../docs/Infrastructure/ for service documentation.
services:
# --- SearXNG stack (gluetun + searxng + valkey) --------------------------
# These three services are now boot-persistent Quadlet units, not compose
# services. They live in searxng/quadlet/ and install to
# ~/.config/containers/systemd/ on the host. searxng reuses gluetun's netns
# (Network=gluetun.container) so its traffic exits the WireGuard tunnel.
# Deploy with: scripts/deploy-searxng-quadlet.sh dankclaw
# See ../docs/Dankclaw/SearXNG.md, Gluetun.md, Valkey.md.
# --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
# Built from Containerfile.comfyui on AMD's gfx1151 torch base. The GPU is
# reached via the /dev/kfd + /dev/dri passthrough (checked host-side; the run
# user is already in the render group). Only the 'video' group is added:
# rootless podman cannot map the render gid into the container namespace.
# Models + data persist under /home/dank/comfyui-data. See ../docs/Dankclaw/ComfyUI.md.
comfyui:
build:
context: .
dockerfile: Containerfile.comfyui
image: comfyui-rocm:gfx1151
container_name: comfyui
restart: unless-stopped
command: ["python", "main.py", "--listen", "0.0.0.0", "--port", "8188"]
ports:
- "8188:8188"
devices:
- /dev/kfd:/dev/kfd
- /dev/dri:/dev/dri
group_add:
- video
- render
volumes:
- /home/dank/comfyui-data/models:/opt/ComfyUI/models
- /home/dank/comfyui-data/input:/opt/ComfyUI/input
- /home/dank/comfyui-data/output:/opt/ComfyUI/output
- /home/dank/comfyui-data/custom_nodes:/opt/ComfyUI/custom_nodes
healthcheck:
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8188/')"]
interval: 30s
timeout: 10s
retries: 5
start_period: 180s
# --- Chat UI (open-webui) ------------------------------------------------
# Now a boot-persistent Quadlet unit (quadlet, slirp4netns, port 3005), not
# a compose service. See open-webui/quadlet/open-webui.container and
# ../docs/Dankclaw/OpenWebUI.md.
hermes:
image: docker.io/nousresearch/hermes-agent:latest
container_name: hermes
network_mode: host
restart: unless-stopped
# The image's default s6 entrypoint runs the interactive TUI, which exits
# without a TTY and crash-loops the container. Override it to run the
# headless gateway (the documented Docker mode). The gateway drops to the
# unprivileged hermes user (uid 10000), so the data dir must be writable by it.
entrypoint: ["bash", "-c", "hermes gateway run --force -v"]
environment:
HERMES_DATA_DIR: /data
# Point hermes's config/.env at the mounted data dir (persistent).
HERMES_HOME: /data
# Signal adapter -> the signal-cli daemon, a HOST process listening on
# :8080. The service runs with network_mode: host below, so it dials
# loopback directly; from a bridge network only DNAT'd published ports
# accept connections to the host LAN IP, and un-forwarded ports refuse
# instantly (verified live 2026-08-30).
SIGNAL_HTTP_URL: "http://127.0.0.1:8080"
SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}"
SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}"
ports:
- "8090:8090"
volumes:
- /home/dank/hermes-data:/data
# No healthcheck: 'hermes gateway run' starts the messaging gateway (Signal
# SSE), not the :8090 web dashboard, so there is no HTTP endpoint to probe.
# The container's running state + the daemon's SSE connection are the signal.
# --- Hermes web dashboard (management UI: config, API keys, sessions) -----
# A separate process from the Signal gateway (the gateway entrypoint does not
# start the dashboard). Bound to the LAN with basic auth: the username + a
# scrypt password_hash live in the git-ignored /home/dank/hermes-data config.
# Port 9119 is published so a browser on the LAN can reach it.
hermes-dashboard:
image: docker.io/nousresearch/hermes-agent:latest
container_name: hermes-dashboard
restart: unless-stopped
entrypoint: ["bash", "-c", "hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build"]
environment:
HERMES_DATA_DIR: /data
HERMES_HOME: /data
ports:
- "9119:9119"
volumes:
- /home/dank/hermes-data:/data
# --- Hermes web UI (Hermex server; phone-facing API for the agent) --------
# Runs the open-source hermes-webui (github.com/nesquena/hermes-webui) in
# foreground mode: bootstrap.py creates .venv inside the mounted checkout,
# installs WebUI + agent deps, then execs server.py as a single foreground
# process. It reads HERMES_HOME=/data, so it drives the SAME agent state
# (memory, skills, sessions) as the gateway container.
# Loopback-only publish: the SSH tunnel (phone -> Dankclaw:22) is the sole
# ingress. The password gates Hermex logins and lives in the host .env.
hermes-webui:
image: docker.io/nousresearch/hermes-agent:latest
container_name: hermes-webui
restart: unless-stopped
entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"]
environment:
HERMES_HOME: /data
# Container-internal bind: 0.0.0.0 so Podman's port forwarder (which
# dials the container's bridge IP) can reach it. The *host-side*
# publish below stays on 127.0.0.1, so loopback-only ingress holds.
HERMES_WEBUI_HOST: 0.0.0.0
HERMES_WEBUI_PORT: "8787"
HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}"
# Headless host: never show the first-run wizard (a profile already
# exists in /data from the gateway).
HERMES_WEBUI_SKIP_ONBOARDING: "1"
ports:
- "127.0.0.1:8787:8787"
volumes:
- /home/dank/hermes-data:/data
# rw on purpose: bootstrap.py creates /webui/.venv in the repo root.
- /home/dank/hermes-webui:/webui
healthcheck:
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/health')"]
interval: 30s
timeout: 10s
retries: 5
# First boot pip-installs WebUI + agent deps into a fresh venv.
start_period: 600s
# --- Git hosting (Gitea) -------------------------------------------------
# Now boot-persistent Quadlet units (private bridge network, DNS enabled),
# not compose services. See gitea/quadlet/ and ../docs/Dankclaw/Gitea.md.
# --- Observability -------------------------------------------------------
prometheus:
image: docker.io/prom/prometheus:latest
container_name: prometheus
restart: unless-stopped
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/prometheus/data. The image's default user (nobody) maps to
# a subuid that cannot write it.
user: "0:0"
command:
- --config.file=/etc/prometheus/prometheus.yml
- --storage.tsdb.path=/prometheus
- --storage.tsdb.retention.time=30d
- --web.enable-lifecycle
ports:
- "9090:9090"
volumes:
- /opt/prometheus/config:/etc/prometheus
- /opt/prometheus/data:/prometheus
healthcheck:
test: ["CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy"]
interval: 30s
timeout: 10s
retries: 3
grafana:
image: docker.io/grafana/grafana:latest
container_name: grafana
restart: unless-stopped
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/grafana/data. The image's default user (472) maps to a
# subuid that cannot write it.
user: "0:0"
environment:
GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD}"
ports:
- "3002:3000"
volumes:
- /opt/grafana/data:/var/lib/grafana
- /opt/grafana/provisioning:/etc/grafana/provisioning:ro
depends_on:
- prometheus
healthcheck:
test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
interval: 30s
timeout: 10s
retries: 3
loki:
# Local build: grafana/loki + static busybox (healthcheck).
image: franksdank/loki:latest
container_name: loki
restart: unless-stopped
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/loki/data. The image's default user (10001) maps to a
# subuid that cannot write it.
user: "0:0"
command: ["-config.file=/etc/loki/loki-config.yaml"]
ports:
- "3100:3100"
volumes:
- /opt/loki/config:/etc/loki
- /opt/loki/data:/loki
healthcheck:
test: ["CMD", "/usr/local/bin/busybox", "wget", "--spider", "-q", "http://localhost:3100/ready"]
interval: 30s
timeout: 10s
retries: 3
alloy:
# Local build: grafana/alloy + static busybox (healthcheck).
image: franksdank/alloy:latest
container_name: alloy
restart: unless-stopped
volumes:
- /opt/alloy/config:/etc/alloy
- /run/systemd/journal/socket:/run/systemd/journal/socket:ro
- /var/log:/var/log:ro
- /var/lib/containers:/var/lib/containers:ro
depends_on:
- loki
healthcheck:
test: ["CMD", "/usr/local/bin/busybox", "wget", "--spider", "-q", "http://localhost:12345/-/healthy"]
interval: 30s
timeout: 10s
retries: 3
node-exporter:
image: docker.io/prom/node-exporter:latest
container_name: node-exporter
restart: unless-stopped
network_mode: host
pid: host
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- --path.procfs=/host/proc
- --path.sysfs=/host/sys
- --path.rootfs=/rootfs
healthcheck:
test: ["CMD", "wget", "--spider", "-q", "http://localhost:9100/metrics"]
interval: 30s
timeout: 10s
retries: 3
# --- Authentik (SSO / OIDC provider) -------------------------------------
# Now boot-persistent Quadlet units, not compose services: authentik-
# postgres -> authentik-server -> authentik-worker start in dependency order
# via ~/.config/containers/systemd/*.container on the host (repo source:
# dankclaw/authentik/quadlet/; deploy-remote.sh deploy_authentik installs
# and starts them). Redis was removed in 2025.10 (sessions/caching moved to
# PostgreSQL). The Caddyfile's forward_auth vhosts proxy to
# authentik-server:9000 over the dankclaw_default network (A2A DNS).
# See ../docs/Infrastructure/Authentik.md.
# Caddy (the homelab's single reverse proxy) left compose on 2026-08-26:
# it is boot-persistent via its Quadlet unit (dankclaw/caddy/quadlet/
# caddy.container), installed by deploy_caddy in scripts/deploy-remote.sh.
# The rendered Caddyfile, certs, and config still live under
# /home/dank/Containers/caddy (rootless-writable).
Reference in New Issue View Git Blame Copy Permalink