0 Fork 0

Files

T

Frank 2e179b024d docs(hermes): document namespace addressability and fix stale claims

New page Architecture/Container Network Namespaces.md: which local services are
addressable from which Podman network namespace on Dankclaw (rootless podman +
netavark). Verified live 2026-09-02: gateway/webui/CDP run in the host netns and
dial loopback; hermes-dashboard is the only Hermes container on a bridge network
(dankclaw_default, 10.89.1.0/24 gw 10.89.1.1) and can dial published ports only —
unpublished host-netns listeners (signal-cli :8080, webui :8787) are refused from
that namespace even though both bind 0.0.0.0.

Corrected while verifying the above:
- Hermes.md: data root is /home/dank/Containers/hermes/data (not the retired
  /home/dank/hermes-data); gateway dials the Signal daemon on loopback; the
  daemon itself is a host user unit (signal-cli-daemon.service) bound to
  0.0.0.0:8080, so the Signal HTTP API is LAN-reachable.
- Hermes-Dashboard.md: it is a Quadlet unit (Network=dankclaw_default), not a
  compose service; data root + /opt/data anonymous volume corrected.
- Hermes-WebUI.md: binds 0.0.0.0:8787 in the host netns (verified: unauthenticated
  GET /health from another LAN machine returned 200) — the SSH tunnel is an access
  path, not a containment boundary; HealthCmd and data-path corrections.
- Network Architecture.md: no hermes vhost exists in either the tracked or the live
  Caddyfile (hermes.franksdank.cloud resolves but routes nowhere); SearXNG exits the
  tunnel via the shared named network searxng.network, not service:gluetun.

Docs only — deploy is a no-op for this change.

2026-09-02 16:10:57 -07:00

3.2 KiB

Raw Blame History

Hermes-Dashboard

The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See Hermes.

Host: Dankclaw — Port: 9119 — URL: http://192.168.0.143:9119

Facts

Item	Value
Image	`docker.io/nousresearch/hermes-agent:latest` (same as the gateway)
Command	`hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build`
Port	`9119` (published to the LAN)
Auth	HTTP basic auth (username + scrypt password hash)
Data	bind mount `/home/dank/Containers/hermes/data` → `/data`, shared with the gateway; plus a fresh anonymous volume at `/opt/data` per recreation

Why a separate container

The gateway container runs hermes gateway run (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process, so it runs in its own Quadlet unit (dankclaw/hermes/quadlet/hermes-dashboard.container: image localhost/hermes-agent:latest, Pull=never, Exec=hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build, Restart=always, RestartSec=5). All three Hermes containers mount the same /data bind mount.

Unlike its two siblings — hermes.container and hermes-webui.container both run with Network=host — the dashboard is the only Hermes container on a bridge network (Network=dankclaw_default, subnet 10.89.1.0/24, gateway 10.89.1.1). That has a functional consequence: from inside its namespace it can dial only published ports via the gateway IP, and host.containers.internal (169.254.1.2) is an alias on the default podman network that this container is not attached to, so probes to it time out. It therefore never talks to the gateway, the webui, or the CDP daemon over the network — it shares their state through the bind mount instead. See Container Network Namespaces.

Authentication

The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:

dashboard.basic_auth.username and dashboard.basic_auth.password_hash live in the live /data/config.yaml (host path /home/dank/Containers/hermes/data/config.yaml); the tracked backup at dankclaw/hermes/config.yaml.example intentionally omits the password hash.
The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
The hash is generated with plugins.dashboard_auth.basic.hash_password.

Access

Open http://192.168.0.143:9119 in a browser on the LAN. Log in with the configured username and password.

Gotchas

The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
--skip-build uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.

3.2 KiB Raw Blame History