Files

T

Frank 327e78b950 docs(vault): destroy the dead weight — 53 pages and the change diary

The vault was 155 pages / 31,210 lines, most of it measurement ledgers for
payloads that no longer run. A throughput figure for a runtime nobody operates is
not a record: AI moves faster than the vault, so the number is wrong before
anyone reads it, and a wrong number in a runbook gets believed. Per the new
purpose test in `AGENTS.md` → *Documentation Policy*, it is destroyed.

Gone (`.AGENTTRASH/20261019-destruction/`, KILL-LIST.txt is the manifest):
- the `frank-medium` endpoint and its five era pages, `frank-npu`, FastFlowLM,
  the ikllama/kingjones/dealign/frank-redo eras, the ling/swift15/freetoken/ubatch
  campaign pages, qwen3.8 spec-matrix and strix-optimizations, the two
  "Running Qwen3.6 …" pages;
- the whole `Pipeline Parallelism/` folder (no live script passes a pipeline flag)
  and the multi-device/x4-pair/hybrid/offload experiment pages;
- every vLLM page — no vLLM endpoint exists on this fleet;
- `LLM/deployment.md` (`Architecture/Deployment Flow.md` is the test-referenced
  owner) and the external surveys (SGLang, Lemonade, llama.cpp forks/diff,
  self-hosted app census, the TTS survey) that were obsolete by construction;
- `log.md`, 2,380 lines. Git holds the chronology; a causal law belongs to the
  page that owns the thing it governs, never to a diary.

Survivors: 101 pages, 17,542 lines, 0 OKF violations, 0 unresolved links. Eras
tables keep the window, payload, runtime, reason and rollback pointer; the rate
columns are blanked. The live shapes stay verbatim — those numbers are what the
deployer and `models.yml` consume.

2026-10-19 10:56:37 -07:00

4.3 KiB

Raw Blame History

type, description, tags, timestamp

type

description

Hermes-Dashboard

The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See Hermes.

Host: Dankclaw — Port: 9119 (published) — URL: https://hermesadmin.franksdank.cloud (internal-only; direct Caddy proxy, no guard chain) or http://192.168.0.143:9119

Facts

Item	Value
Image	`docker.io/nousresearch/hermes-agent:latest` (same as the gateway)
Command	`hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build`
Port	`9119` (published to the LAN)
Auth	HTTP basic auth (username + scrypt password hash)
Data	bind mount `/home/dank/Containers/hermes/data` → `/data`, shared with the gateway; plus a fresh anonymous volume at `/opt/data` per recreation

Why a separate container

The gateway container runs hermes gateway run (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process, so it runs in its own Quadlet unit (dankclaw/hermes/quadlet/hermes-dashboard.container: image localhost/hermes-agent:latest, Pull=never, Exec=hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build, Restart=always RestartSec=5). All three Hermes containers mount the same /data bind mount.

Unlike its two siblings — hermes.container and hermes-webui.container both run with Network=host — the dashboard is the only Hermes container on a bridge network (Network=dankclaw_default, subnet 10.89.1.0/24, gateway 10.89.1.1). That has a functional consequence: from inside its namespace it can dial only published ports via the gateway IP, and host.containers.internal (169.254.1.2) is an alias on the default podman network that this container is not attached to, so probes to it time out. It therefore never talks to the gateway, the webui, or the CDP daemon over the network — it shares their state through the bind mount instead. See Container Network Namespaces.

Authentication

The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:

dashboard.basic_auth.username and dashboard.basic_auth.password_hash live in the live /data/config.yaml (host path /home/dank/Containers/hermes/data/config.yaml); the tracked backup at dankclaw/hermes/config.yaml.example intentionally omits the password hash.
The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
The hash is generated with plugins.dashboard_auth.basic.hash_password.

Access

Two paths reach the same process, both gated by the dashboard's own basic-auth login — there is no unauthenticated bind:

https://hermesadmin.franksdank.cloud — Caddy vhost added 2026-09-02 that reverse-proxies 192.168.0.143:9119 directly, with no Anubis/Outpost guard chain in front of it (exempt-by-construction: the app carries its own complete auth). The name deliberately has no public DNS record, so the vhost resolves on the LAN only; WAN clients get NXDOMAIN. See LAN-DNS.
http://192.168.0.143:9119 — the raw published port. Still reachable from any LAN host (the container binds 0.0.0.0 inside its namespace and publishes 9119:9119), so treat the LAN as a trusted boundary here, not as a gate. See Container Network Namespaces for why this container is on a bridge network rather than the host namespace like its two siblings.

Gotchas

The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
--skip-build uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.

4.3 KiB Raw Blame History