Files

T

Frank 93d1181fee docs: OKF v0.1 compliance pass + fact-check + 3 research briefs

- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM
- Restructure log.md to OKF (## YYYY-MM-DD, newest-first)
- Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change
- Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe)
- Write active runbook bodies from ground truth (frank-large, frank-small)
- Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026)
- Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs
- All 336 tests pass; 136 pages, 0 unresolved wikilinks

2026-09-22 02:09:41 -07:00

4.3 KiB

Raw Blame History

type, description, tags, timestamp

type

description

Hermes-Dashboard

The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See Hermes.

Host: Dankclaw — Port: 9119 (published) — URL: https://hermesadmin.franksdank.cloud (internal-only; direct Caddy proxy, no guard chain) or http://192.168.0.143:9119

Facts

Item	Value
Image	`docker.io/nousresearch/hermes-agent:latest` (same as the gateway)
Command	`hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build`
Port	`9119` (published to the LAN)
Auth	HTTP basic auth (username + scrypt password hash)
Data	bind mount `/home/dank/Containers/hermes/data` → `/data`, shared with the gateway; plus a fresh anonymous volume at `/opt/data` per recreation

Why a separate container

The gateway container runs hermes gateway run (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process, so it runs in its own Quadlet unit (dankclaw/hermes/quadlet/hermes-dashboard.container: image localhost/hermes-agent:latest, Pull=never, Exec=hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build, Restart=always, RestartSec=5). All three Hermes containers mount the same /data bind mount.

Unlike its two siblings — hermes.container and hermes-webui.container both run with Network=host — the dashboard is the only Hermes container on a bridge network (Network=dankclaw_default, subnet 10.89.1.0/24, gateway 10.89.1.1). That has a functional consequence: from inside its namespace it can dial only published ports via the gateway IP, and host.containers.internal (169.254.1.2) is an alias on the default podman network that this container is not attached to, so probes to it time out. It therefore never talks to the gateway, the webui, or the CDP daemon over the network — it shares their state through the bind mount instead. See Container Network Namespaces.

Authentication

The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:

dashboard.basic_auth.username and dashboard.basic_auth.password_hash live in the live /data/config.yaml (host path /home/dank/Containers/hermes/data/config.yaml); the tracked backup at dankclaw/hermes/config.yaml.example intentionally omits the password hash.
The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
The hash is generated with plugins.dashboard_auth.basic.hash_password.

Access

Two paths reach the same process, both gated by the dashboard's own basic-auth login — there is no unauthenticated bind:

https://hermesadmin.franksdank.cloud — Caddy vhost added 2026-09-02 that reverse-proxies 192.168.0.143:9119 directly, with no Anubis/Outpost guard chain in front of it (exempt-by-construction: the app carries its own complete auth). The name deliberately has no public DNS record, so the vhost resolves on the LAN only; WAN clients get NXDOMAIN. See LAN-DNS.
http://192.168.0.143:9119 — the raw published port. Still reachable from any LAN host (the container binds 0.0.0.0 inside its namespace and publishes 9119:9119), so treat the LAN as a trusted boundary here, not as a gate. See Container Network Namespaces for why this container is on a bridge network rather than the host namespace like its two siblings.

Gotchas

The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
--skip-build uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.

4.3 KiB Raw Blame History