Frank
1e491fa69f
Post-change doc reconciliation for the hermes vhosts + DNS deletion batch: - Hermes-Dashboard.md: access is now the hermesadmin.franksdank.cloud vhost (direct Caddy proxy to 192.168.0.143:9119, no guard chain — exempt because the dashboard enforces its own basic-auth login), plus the raw LAN port. The old text claimed an Authentik-guarded public vhost, which was decommissioned. - Hermes-WebUI.md: description updated — the webui is now also reachable via the unguarded hermes.franksdank.cloud vhost (its own password auth is the gate). - LAN-DNS.md: "add a name in two places" corrected to a two-or-three-step decision; internal-only names (prometheus/loki/grafana/seerr) deliberately get no public A record and resolve on the LAN only, and DNS-01 issuance is unaffected because the challenge is a TXT record in the same zone. - Seerr.md: DNS row corrected — addn-hosts only since 2026-09-02; NXDOMAIN on WAN. - hermes-dashboard.container: unit comment no longer claims Authentik termination. No behavior change in this commit; tests 233/233 green (docs-completeness seam included).
34 lines
1.2 KiB
INI
34 lines
1.2 KiB
INI
# Quadlet unit: Hermes web dashboard (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/hermes-dashboard.container
|
|
# Unit name: hermes-dashboard.service (container name: hermes-dashboard)
|
|
#
|
|
# Management UI for the agent (config, API keys, sessions). Published on
|
|
# 9119 on network dankclaw_default; Caddy's hermesadmin.franksdank.cloud vhost
|
|
# reverse-proxies this port directly (no guard chain) because the dashboard
|
|
# enforces its own basic-auth login from /data/config.yaml
|
|
# (basic_auth.username + scrypt password_hash), making it exempt-by-construction.
|
|
# The name has no public DNS record, so the vhost resolves on the LAN only.
|
|
# Shares /data with the gateway: same agent state, two processes.
|
|
|
|
[Unit]
|
|
Description=Hermes web dashboard container
|
|
|
|
[Container]
|
|
ContainerName=hermes-dashboard
|
|
Image=localhost/hermes-agent:latest
|
|
Pull=never
|
|
Network=dankclaw_default
|
|
Environment=HERMES_DATA_DIR=/data
|
|
Environment=HERMES_HOME=/data
|
|
Volume=/home/dank/Containers/hermes/data:/data
|
|
PublishPort=9119:9119
|
|
Exec=bash -c 'hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build'
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|