Add Hermes Agent as reproducible second client

platform/hermes/config.yaml

@@ -0,0 +1,86 @@
+_config_version: 38
+
+model:
+  default: "qwen-medium"
+  provider: "custom"
+  base_url: "http://router:8081/v1"
+  api_key: "${ROUTER_API_KEY}"
+  context_length: 160000
+  api_mode: "chat_completions"
+
+# Commands run in an isolated, persistent workspace. Host and Unraid changes
+# use the audited operator/MUA MCPs instead of a Docker socket or host mount.
+terminal:
+  backend: "local"
+  cwd: "/workspace"
+  timeout: 600
+  home_mode: "profile"
+  persistent_shell: true
+  lifetime_seconds: 1800
+
+web:
+  search_backend: "searxng"
+  extract_backend: "native"
+  extract_char_limit: 15000
+  keyless_fallback: true
+  keyless_rescue: true
+
+agent:
+  max_turns: 100
+  gateway_timeout: 3600
+  session_stall_timeout: 600
+
+skills:
+  creation_nudge_interval: 20
+
+plugins:
+  enabled: ["web-searxng"]
+
+timeouts:
+  tools:
+    concurrent_batch: 900
+    sequential_call: 900
+
+mcp_servers:
+  athena-platform:
+    url: "http://mcp-platform-context:8000/mcp"
+    timeout: 180
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  athena-operator:
+    url: "http://mcp-athena-operator:8000/mcp"
+    timeout: 900
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  web-general:
+    url: "http://tinysearch:8000/mcp"
+    timeout: 180
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  github:
+    url: "http://mcp-github:8000/mcp"
+    timeout: 300
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  homeassistant:
+    url: "http://mcp-homeassistant:8000/mcp"
+    timeout: 300
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  arr:
+    url: "http://mcp-arr:8000/mcp"
+    timeout: 600
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  navidrome:
+    url: "http://mike-ai-mcp-navidrome:3000/mcp"
+    timeout: 300
+    connect_timeout: 30
+    supports_parallel_tool_calls: false
+  unraid:
+    url: "${MUA_MCP_URL}"
+    headers:
+      Authorization: "Bearer ${MUA_MCP_BEARER_TOKEN}"
+    timeout: 900
+    connect_timeout: 30
+    supports_parallel_tool_calls: false

platform/hermes/install-hermes.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+STACK_DIR=${STACK_DIR:-/opt/mike-ai/stack}
+SECRETS_DIR=${SECRETS_DIR:-/etc/mike-ai}
+HERMES_DATA_DIR=${HERMES_DATA_DIR:-/data/hermes}
+MUA_ENV=${MUA_ENV:-$SECRETS_DIR/mua-mcp.env}
+
+die() { printf 'FEHLER: %s\n' "$*" >&2; exit 1; }
+[[ $EUID -eq 0 ]] || die "Bitte als root ausführen."
+[[ -s $SECRETS_DIR/router-api-key ]] || die "Router-API-Key fehlt."
+[[ -s $STACK_DIR/platform/hermes/config.yaml ]] || die "Hermes-Konfiguration fehlt im Stack."
+
+install -d -m 0700 "$HERMES_DATA_DIR"
+install -d -m 0750 "$HERMES_DATA_DIR/workspace"
+[[ -s $SECRETS_DIR/hermes-api-key ]] || openssl rand -base64 48 >"$SECRETS_DIR/hermes-api-key"
+[[ -s $SECRETS_DIR/hermes-dashboard-password ]] || openssl rand -base64 24 >"$SECRETS_DIR/hermes-dashboard-password"
+[[ -s $SECRETS_DIR/hermes-dashboard-secret ]] || openssl rand -base64 48 >"$SECRETS_DIR/hermes-dashboard-secret"
+chmod 0600 "$SECRETS_DIR/hermes-api-key" \
+  "$SECRETS_DIR/hermes-dashboard-password" \
+  "$SECRETS_DIR/hermes-dashboard-secret"
+
+router_key=$(<"$SECRETS_DIR/router-api-key")
+mua_url=http://127.0.0.1:9/mcp
+mua_token=not-configured
+if [[ -s $MUA_ENV ]]; then
+  mua_url=$(sed -n 's/^MUA_MCP_URL=//p' "$MUA_ENV" | head -n 1)
+  mua_token=$(sed -n 's/^MUA_MCP_BEARER_TOKEN=//p' "$MUA_ENV" | head -n 1)
+  [[ -n $mua_url && -n $mua_token ]] || die "MUA URL oder Token fehlt."
+fi
+
+cat >"$HERMES_DATA_DIR/.env" <<EOF
+ROUTER_API_KEY=$router_key
+MUA_MCP_URL=$mua_url
+MUA_MCP_BEARER_TOKEN=$mua_token
+SEARXNG_URL=http://searxng:8080
+API_SERVER_ENABLED=true
+API_SERVER_HOST=0.0.0.0
+API_SERVER_PORT=8642
+API_SERVER_KEY=$(<"$SECRETS_DIR/hermes-api-key")
+API_SERVER_MODEL_NAME=MikeAI-Hermes
+HERMES_DASHBOARD=1
+HERMES_DASHBOARD_HOST=0.0.0.0
+HERMES_DASHBOARD_PORT=9119
+HERMES_DASHBOARD_BASIC_AUTH_USERNAME=michael
+HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=$(<"$SECRETS_DIR/hermes-dashboard-password")
+HERMES_DASHBOARD_BASIC_AUTH_SECRET=$(<"$SECRETS_DIR/hermes-dashboard-secret")
+EOF
+chmod 0600 "$HERMES_DATA_DIR/.env"
+
+if [[ -s $HERMES_DATA_DIR/config.yaml ]] && \
+   ! cmp -s "$STACK_DIR/platform/hermes/config.yaml" "$HERMES_DATA_DIR/config.yaml"; then
+  cp -a "$HERMES_DATA_DIR/config.yaml" \
+    "$HERMES_DATA_DIR/config.yaml.before-managed-update-$(date +%Y%m%d-%H%M%S)"
+fi
+install -m 0600 "$STACK_DIR/platform/hermes/config.yaml" "$HERMES_DATA_DIR/config.yaml"
+printf 'HERMES_CONFIG_OK %s\n' "$HERMES_DATA_DIR"