hermes-stack/.env.example at main · corv89/hermes-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# Copy to .env and fill in real values. .env is gitignored.
# run.py requires all eight keys to be set.

# Login password for the Hermes WebUI (http://127.0.0.1:8787).
HERMES_WEBUI_PASSWORD=***

# Z.AI (GLM) API key used by the Hermes agent as its model provider.
ZAI_API_KEY=***

# Z.AI (GLM) API key for the OpenCode server (hermes-opencode container).
# Passed in as ZHIPU_API_KEY so opencode2 authenticates the zai-coding-plan
# provider (api.z.ai/api/coding/paas/v4). Kept separate from ZAI_API_KEY
# (Hermes own key) on purpose.
OPENCODE_ZHIPU_API_KEY=***

# Stable shared OpenCode API password. Passed to BOTH the opencode server (as
# OPENCODE_PASSWORD, so it does not generate a random one) and the webui,
# keeping them in sync across plain `podman pod start` (boot) and run.py.
OPENCODE_SERVER_PASSWORD=***

# gbrain ADMIN bootstrap token. Must be >=32 chars and match [A-Za-z0-9_-]+
# (gbrain refuses to start with a weak one). Authenticates the gbrain /admin UI;
# it is NOT the Hermes MCP bearer (run.py mints a separate OAuth access token
# for that, persisted under config/.mcp-client.json). Generate with:
#   openssl rand -hex 32
GBRAIN_ADMIN_TOKEN=***

# Shared token between the hermes-pah service and the webui's `pc` client
# (X-PAH-Token header on every route). hermesnet-internal only — the service
# publishes no port. Optional: run.py mints a random one (secrets.token_hex)
# when unset; service and client are always rendered in the same pass, so
# they agree. Set a stable value to keep it constant across renders:
#   openssl rand -hex 20
PAH_TOKEN=

# --- Dashboard (Hermes Desktop Remote Gateway) ---------------------------
# Basic auth for the `hermes dashboard` backend on 127.0.0.1:9119 (exposed
# via `tailscale serve --https=9443 9119`). REQUIRED — run.py aborts without
# them; never auto-generated (a rotated secret invalidates Desktop's saved
# sign-in). Generate:
#   openssl rand -hex 16        # password
#   openssl rand -base64 32     # secret (restart-stable sessions)
HERMES_DASHBOARD_BASIC_AUTH_USERNAME=hermes-admin
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=
HERMES_DASHBOARD_BASIC_AUTH_SECRET=

# --- Forgejo (git forge) -------------------------------------------------
# Admin account bootstrapped by run.py (forgejo_bootstrap). The web
# installer is disabled (INSTALL_LOCK), so this password is required.
FORGEJO_ADMIN_USER=admin
FORGEJO_ADMIN_EMAIL=you@example.com
FORGEJO_ADMIN_PASSWORD=***
# Optional: public URL for links/emails once exposed via Tailscale serve.
#FORGEJO_ROOT_URL=https://forge.example.ts.net/

# --- GPU topology (optional overrides) ---------------------------------------
# Machine-specific GPU pinning. run.py defaults suit the reference host; on a
# different box override the PCI BDF of each GPU and its KFD device_id
# (`lspci | grep -i vga` for the BDF, `cat
# /sys/class/kfd/kfd/topology/nodes/*/properties` for the device_id):
#GPU_PCI_AUX=0000:06:00.0        # aux GPU: embed/rerank/whisper
#GPU_PCI_ROCM=0000:0e:00.0       # sidecar GPU
#GPU_DEV_ID_AUX=0x7550
#GPU_DEV_ID_SIDECAR=0x7551

# --- sourcebot (optional add-on) ----------------------------------------------
# The sourcebot unit (and its secrets + readiness gate) is skipped when the
# checkout is absent. It is private and not published; point at the checkout
# to enable it (the image is built separately in its own repo):
#SOURCEBOT_HOME=/home/USER/Src/sourcebot

# --- Buzz (optional Nostr community platform) ----------------------------------
# Join a buzz.xyz community relay as a native Hermes messaging platform.
# ALL keys optional: unset (default) = platform disabled, gateway unaffected.
# Enable by setting BOTH BUZZ_RELAY_URL and BUZZ_PRIVATE_KEY. You generate
# the nsec and join the community relay as that identity yourself — the pod
# never generates or rotates keys. BUZZ_PRIVATE_KEY is the only secret.
#BUZZ_RELAY_URL=wss://relay.example.com     # community relay (enables buzz)
#BUZZ_PRIVATE_KEY=nsec1...                  # agent's Nostr identity, already a community member (enables buzz)
#BUZZ_HOME_CHANNEL=general                  # default channel; also the `deliver=buzz` cron target
#BUZZ_CHANNELS=general,random               # comma-separated channel allowlist
#BUZZ_ALLOWED_USERS=npub1...,npub1...       # npubs that may talk to the agent (private mode)
#BUZZ_ALLOW_ALL_USERS=false                 # keep false: private mode is the default
#BUZZ_POLL_INTERVAL=4                       # poll transport interval (s); default 4
#BUZZ_TRANSPORT=auto                        # auto | websocket | poll
#BUZZ_AUTH_TAG=                             # relay auth tag, if the community requires one
#BUZZ_CLI_PATH=                             # default: `buzz` on PATH (baked into the webui image)
#BUZZ_CREDENTIALS_FILE=/home/hermeswebui/.hermes/buzz/credentials.json
#                                           # point at the hermes-data volume so CLI state survives redeploys