Simplify Athena runtime and document current architecture

install.sh

@@ -301,30 +301,14 @@ install_stack_files() {
   install -d -m 0700 "$SECRETS_DIR"
   [[ -s $SECRETS_DIR/router-api-key ]] || openssl rand -base64 48 >$SECRETS_DIR/router-api-key
   [[ -s $SECRETS_DIR/controller-token ]] || openssl rand -base64 48 >$SECRETS_DIR/controller-token
-  [[ -s $SECRETS_DIR/webui-secret ]] || openssl rand -base64 48 >$SECRETS_DIR/webui-secret
   chmod 0600 "$SECRETS_DIR"/*
 
-  local searx="$STACK_DIR/platform/web-search/searxng-settings.yml"
-  if [[ ! -s $searx ]]; then
-    cp "$STACK_DIR/platform/web-search/searxng-settings.example.yml" "$searx"
-    sed -i "s/CHANGE_ME_GENERATE_RANDOM_SECRET/$(openssl rand -hex 32)/" "$searx"
-  fi
-  # The official image reads this as its unprivileged uid (977).
-  chown root:977 "$searx"
-  chmod 0640 "$searx"
-
   cat >$SECRETS_DIR/stack.env <<EOF
 AI_BIND_ADDRESS=${AI_BIND_ADDRESS:-127.0.0.1}
 MODEL_DIR=$MODEL_DIR
 WIREGUARD_CONFIG_FILE=${WIREGUARD_CONFIG_FILE:-/etc/mike-ai/wireguard/fritz-athena.conf}
 ROUTER_API_KEY=$(<$SECRETS_DIR/router-api-key)
 CONTROLLER_TOKEN=$(<$SECRETS_DIR/controller-token)
-WEBUI_SECRET_KEY=$(<$SECRETS_DIR/webui-secret)
-OPENWEBUI_IMAGE=${OPENWEBUI_IMAGE:-mike-ai/openwebui:main-01f4282-tool-final-v3}
-OPENWEBUI_ENABLE_SIGNUP=${OPENWEBUI_ENABLE_SIGNUP:-false}
-OPENWEBUI_ENABLE_FOLLOW_UP_GENERATION=${OPENWEBUI_ENABLE_FOLLOW_UP_GENERATION:-false}
-HERMES_IMAGE=${HERMES_IMAGE:-mike-ai/hermes-agent:0.20.5-mcpfix1}
-HERMES_WEBUI_IMAGE=${HERMES_WEBUI_IMAGE:-mike-ai/hermes-webui:0.52.113-hermes-source-v1}
 PIPER_TTS_VERSION=${PIPER_TTS_VERSION:-1.6.0}
 PIPER_VOICE=${PIPER_VOICE:-de_DE-thorsten-high}
 XTTS_IMAGE=${XTTS_IMAGE:-ghcr.io/coqui-ai/xtts-streaming-server:latest-cuda121@sha256:f7fb3b1f9d4bc88af94da1b5959d8002f1e0b003c97557164034eb8a29f01b90}
@@ -357,7 +341,7 @@ UNCENSORED_TENSOR_SPLIT=${UNCENSORED_TENSOR_SPLIT:-90,10}
 UNCENSORED_MTP_MAX=${UNCENSORED_MTP_MAX:-2}
 EXPERIMENTAL_GPU_DEVICES=${TEXT_GPU_DEVICES:-0}
 IMAGE_GPU_DEVICES=${IMAGE_GPU_DEVICES:-${TEXT_GPU_DEVICES:-0}}
-FLUX_MODEL_DIR=${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}
+Z_IMAGE_MODEL_DIR=${Z_IMAGE_MODEL_DIR:-/data/models/Z-Image-Turbo}
 LLAMA_THREADS=${LLAMA_THREADS:-6}
 LLAMA_THREADS_BATCH=${LLAMA_THREADS_BATCH:-6}
 EOF
@@ -475,24 +459,24 @@ build_and_start() {
   cd "$STACK_DIR"
   docker build --progress=plain --build-arg LLAMA_CPP_COMMIT="$commit" \
     -f platform/docker/llama-cpp/Dockerfile -t mike-ai/llama.cpp:local .
-  docker compose --env-file "$SECRETS_DIR/stack.env" --profile image build flux-worker
-  if [[ ! -s ${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}/model_index.json ]]; then
-    log "FLUX.2 Klein Distilled laden"
-    install -d -m 0755 "${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}"
+  docker compose --env-file "$SECRETS_DIR/stack.env" --profile image build image-worker
+  if [[ ! -s ${Z_IMAGE_MODEL_DIR:-/data/models/Z-Image-Turbo}/model_index.json ]]; then
+    log "Z-Image-Turbo laden"
+    install -d -m 0755 "${Z_IMAGE_MODEL_DIR:-/data/models/Z-Image-Turbo}"
     docker run --rm --entrypoint python \
-      -v "${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}:/download" \
-      mike-ai/flux-worker:local -c \
-      "from huggingface_hub import snapshot_download; snapshot_download('black-forest-labs/FLUX.2-klein-4B', revision='303481f0390afb112393f9d77e8f0be72fcefeb7', local_dir='/download')"
-    chmod -R a-w "${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}"
+      -v "${Z_IMAGE_MODEL_DIR:-/data/models/Z-Image-Turbo}:/download" \
+      mike-ai/image-worker:local -c \
+      "from huggingface_hub import snapshot_download; snapshot_download('Tongyi-MAI/Z-Image-Turbo', revision='f332072aa78be7aecdf3ee76d5c247082da564a6', local_dir='/download')"
+    chmod -R a-w "${Z_IMAGE_MODEL_DIR:-/data/models/Z-Image-Turbo}"
   fi
   # Creates the tools network and deploys the only host-bound MCP: Operator.
   # Portable MCPs and Hermes live on Unraid and are restored through Appdata.
   "$STACK_DIR/platform/mcp/install-tools.sh"
   docker compose --env-file "$SECRETS_DIR/stack.env" --profile inference create \
     llama-fast llama-medium llama-large llama-ultra llama-experimental
-  docker compose --env-file "$SECRETS_DIR/stack.env" --profile image create flux-worker
+  docker compose --env-file "$SECRETS_DIR/stack.env" --profile image create image-worker
   docker compose --env-file "$SECRETS_DIR/stack.env" up -d --build \
-    wireguard-gateway xtts piper tts-gateway profile-controller router backup
+    wireguard-gateway xtts piper tts-gateway profile-controller router llama-dashboard backup
   if [[ ${WIREGUARD_MODE:-container} == container ]]; then
     systemctl restart mike-ai-container-vpn-guard.service
   fi
@@ -567,7 +551,7 @@ else
 fi
 cat <<EOF
 Router-API: http://${vpn_address}:8081
-Hermes läuft mit MCPHub auf Unraid und nutzt diese Router-API.
+Hermes und die Fach-MCP-Container laufen auf Unraid und nutzen diese Router-API.
 
 Die geheimen Schlüssel liegen ausschließlich unter $SECRETS_DIR (0600).
 Im Container-Modus stammen Peer, Adresse und Heimrouten vollständig aus dem