rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
67 lines
2.5 KiB
YAML
67 lines
2.5 KiB
YAML
---
|
|
hermes_image: nousresearch/hermes-agent:latest
|
|
# missing = only pull if absent (no surprise upgrades on redeploy).
|
|
# Set to "always" when you actually want to upgrade the image.
|
|
hermes_pull_policy: missing
|
|
|
|
hermes_container_name: hermes
|
|
hermes_project_dir: /opt/hermes
|
|
hermes_data_dir: "{{ hermes_project_dir }}/data"
|
|
hermes_secrets_env_file: "{{ hermes_project_dir }}/hermes-secrets.env"
|
|
|
|
# Same network namespace as Paperclip and nginx
|
|
hermes_network_mode: host
|
|
hermes_memory_limit: 8G
|
|
hermes_cpu_limit: "4.0"
|
|
# Playwright/Chromium needs shared memory (upstream troubleshooting note)
|
|
hermes_shm_size: 1g
|
|
|
|
# --- Gateway / API server (loopback only; Paperclip reaches it locally) ---
|
|
hermes_gateway_port: 8642
|
|
hermes_api_server_enabled: true
|
|
hermes_api_server_host: 127.0.0.1
|
|
# Leave empty to run keyless on loopback. If you set one, Paperclip (or any
|
|
# other client) must send it as a bearer token.
|
|
# e.g. hermes_api_server_key: "{{ vault_hermes_api_server_key }}"
|
|
hermes_api_server_key: "{{ vault_hermes_api_server_key }}"
|
|
|
|
# --- Dashboard (bound to loopback, published through nginx) ---
|
|
hermes_dashboard_enabled: true
|
|
hermes_dashboard_host: 127.0.0.1
|
|
hermes_dashboard_port: 9119
|
|
hermes_domain: haunted-mansion.wdw-labs.cloud
|
|
hermes_public_url: "https://{{ hermes_domain }}"
|
|
hermes_dashboard_username: admin
|
|
|
|
# Vault variables this role requires (see README block at bottom of file)
|
|
hermes_required_vault_vars:
|
|
- vault_hermes_dashboard_password_hash
|
|
- vault_hermes_dashboard_secret
|
|
|
|
# --- Preflight ---
|
|
hermes_preflight_ports:
|
|
- "{{ hermes_gateway_port }}"
|
|
- "{{ hermes_dashboard_port }}"
|
|
hermes_wait_timeout: 120
|
|
|
|
# --- config.yaml overrides (deep-merged, only the keys listed here) ---
|
|
# nginx runs with host networking, so it reaches the dashboard from loopback.
|
|
# Model settings are NOT managed by default (your wizard-written config stays
|
|
# untouched). To manage them, add a model block, for example:
|
|
# model:
|
|
# provider: custom
|
|
# model: <served-model-name>
|
|
# base_url: http://10.1.71.130:8000/v1
|
|
# api_key: "{{ vault_vllm_api_key }}"
|
|
hermes_config_overrides:
|
|
dashboard:
|
|
trusted_proxies:
|
|
- "127.0.0.1"
|
|
|
|
# Required vault vars:
|
|
# vault_hermes_dashboard_password_hash - output of hash_password() (see below)
|
|
# vault_hermes_dashboard_secret - openssl rand -base64 32
|
|
# Generate the hash with:
|
|
# docker exec -it -w /opt/hermes hermes /opt/hermes/.venv/bin/python -c \
|
|
# "from plugins.dashboard_auth.basic import hash_password; print(hash_password('PW'))"
|