---
hermes_image: nousresearch/hermes-agent:latest
# missing = only pull if absent (no surprise upgrades on redeploy).
# Set to "always" when you actually want to upgrade the image.
hermes_pull_policy: missing

hermes_container_name: hermes
hermes_project_dir: /opt/hermes
hermes_data_dir: "{{ hermes_project_dir }}/data"
hermes_secrets_env_file: "{{ hermes_project_dir }}/hermes-secrets.env"

# Same network namespace as Paperclip and nginx
hermes_network_mode: host
hermes_memory_limit: 8G
hermes_cpu_limit: "4.0"
# Playwright/Chromium needs shared memory (upstream troubleshooting note)
hermes_shm_size: 1g

# --- Gateway / API server (loopback only; Paperclip reaches it locally) ---
hermes_gateway_port: 8642
hermes_api_server_enabled: true
hermes_api_server_host: 127.0.0.1
# Leave empty to run keyless on loopback. If you set one, Paperclip (or any
# other client) must send it as a bearer token.
# e.g. hermes_api_server_key: "{{ vault_hermes_api_server_key }}"
hermes_api_server_key: "{{ vault_hermes_api_server_key }}"

# --- Dashboard (bound to loopback, published through nginx) ---
hermes_dashboard_enabled: true
hermes_dashboard_host: 127.0.0.1
hermes_dashboard_port: 9119
hermes_domain: haunted-mansion.wdw-labs.cloud
hermes_public_url: "https://{{ hermes_domain }}"
hermes_dashboard_username: admin

# Vault variables this role requires (see README block at bottom of file)
hermes_required_vault_vars:
  - vault_hermes_dashboard_password_hash
  - vault_hermes_dashboard_secret

# --- Preflight ---
hermes_preflight_ports:
  - "{{ hermes_gateway_port }}"
  - "{{ hermes_dashboard_port }}"
hermes_wait_timeout: 120

# --- config.yaml overrides (deep-merged, only the keys listed here) ---
# nginx runs with host networking, so it reaches the dashboard from loopback.
# Model settings are NOT managed by default (your wizard-written config stays
# untouched). To manage them, add a model block, for example:
#   model:
#     provider: custom
#     model: <served-model-name>
#     base_url: http://10.1.71.130:8000/v1
#     api_key: "{{ vault_vllm_api_key }}"
hermes_config_overrides:
  dashboard:
    trusted_proxies:
      - "127.0.0.1"

# Required vault vars:
#   vault_hermes_dashboard_password_hash  - output of hash_password() (see below)
#   vault_hermes_dashboard_secret         - openssl rand -base64 32
# Generate the hash with:
#   docker exec -it -w /opt/hermes hermes /opt/hermes/.venv/bin/python -c \
#     "from plugins.dashboard_auth.basic import hash_password; print(hash_password('PW'))"