compose.yml

# Production compose file for the Sluice + Hermes stack.
# Pulls pre-built images from registries; no local build required.
# For local development with build-from-source, use:
#   docker compose -f compose.dev.yml up --build
#
# Startup order is enforced via healthcheck + condition: service_healthy:
#   sluice starts first -> tun2proxy waits for sluice /healthz -> hermes
#   waits for tun2proxy TUN device.
#
# Migration from a prior OpenClaw deployment: see bootstrap.sh in the
# repo root. It runs `hermes claw migrate` against the legacy openclaw
# volume one time before the stack comes up.
#
# MCP wiring: Sluice's HermesProfile patches mcp_servers.sluice.url into
# ~/.hermes/config.yaml at startup. Hermes reads that on its next launch
# or via the /reload-mcp slash command.
#
# Hermes layout: HERMES_HOME is overridden to /opt/data/.hermes so that
# sluice's HermesProfile env path (~/.hermes/.env) resolves to the same
# file Hermes reads ($HERMES_HOME/.env). The hermes-home volume is
# mounted at /opt/data/.hermes accordingly.
#
# Network: hermes shares tun2proxy's namespace via network_mode, so all
# its outbound traffic flows through SOCKS5 -> sluice. The caddy sidecar
# fronts the dashboard with TLS because tun0's default route breaks
# Docker's port forwarding (replies exit via tun0 instead of eth0).
services:
  sluice:
    image: ghcr.io/nnemirovsky/sluice:latest
    restart: unless-stopped
    command: [
      "-listen", "0.0.0.0:1080",
      "-health-addr", "0.0.0.0:3000",
      "-mcp-base-url", "http://sluice:3000",
      "-db", "data/sluice.db",
      "-config", "/etc/sluice/config.toml",
      "-audit", "/var/log/sluice/audit.jsonl",
      "-agent", "hermes",
      "-container-name", "hermes",
    ]
    environment:
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
      - SLUICE_AGENT_CONTAINER=hermes
      - SLUICE_AGENT_PROFILE=hermes
      # Set SLUICE_API_TOKEN to enable the REST API on :3000/api/*.
      # All /api/* endpoints require this bearer token for auth.
      # If unset, the API returns 403 on all /api/* routes.
      - SLUICE_API_TOKEN=${SLUICE_API_TOKEN:-}
    group_add:
      - "${DOCKER_GID:-0}"
    volumes:
      - ./config.toml:/etc/sluice/config.toml:ro
      - sluice-data:/home/sluice/data
      - sluice-vault:/home/sluice/.sluice
      - sluice-audit:/var/log/sluice
      - sluice-ca:/home/sluice/ca
      - /var/run/docker.sock:/var/run/docker.sock
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    networks:
      internal:
        ipv4_address: 172.30.0.2
      external: {}

  tun2proxy:
    image: ghcr.io/tun2proxy/tun2proxy-alpine:latest
    restart: unless-stopped
    cap_add: [NET_ADMIN]
    devices:
      - /dev/net/tun:/dev/net/tun
    command: ["--proxy", "socks5://sluice:1080", "--bypass", "127.0.0.0/8", "--bypass", "::1/128"]
    # Hermes uses network_mode: "service:tun2proxy", sharing this
    # container's network namespace. extra_hosts adds a /etc/hosts entry
    # so Hermes (which shares this network namespace) can resolve
    # "sluice" to its pinned internal IP. Without this, DNS goes through
    # the TUN and fails to resolve Docker service names.
    extra_hosts:
      - "sluice:172.30.0.2"
    healthcheck:
      test: ["CMD-SHELL", "ip link show tun0 || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    networks: [internal]
    depends_on:
      sluice:
        condition: service_healthy

  hermes:
    image: nousresearch/hermes-agent:v2026.4.30
    restart: unless-stopped
    container_name: hermes
    network_mode: "service:tun2proxy"
    # Source sluice-injected env vars before starting hermes so phantom
    # tokens are visible to MCP subprocesses spawned by the gateway.
    # /opt/data/.hermes/.env is where sluice's HermesProfile writes them
    # (HERMES_HOME is overridden below to keep the path consistent).
    entrypoint: ["/bin/sh", "-c", "[ -f /opt/data/.hermes/.env ] && set -a && . /opt/data/.hermes/.env && set +a; exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"", "--"]
    command: ["gateway", "run"]
    environment:
      # HOME drives `$HOME` and `~` expansion inside `docker exec` commands
      # that sluice runs to inject phantom tokens and patch config.yaml.
      # Setting it to /opt/data so ~/.hermes/.env resolves to
      # /opt/data/.hermes/.env, which matches HERMES_HOME below.
      - HOME=/opt/data
      - HERMES_HOME=/opt/data/.hermes
      - HERMES_UID=${HERMES_UID:-10000}
      - HERMES_GID=${HERMES_GID:-10000}
      - SSL_CERT_FILE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
      - REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
      - NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
    volumes:
      - hermes-home:/opt/data/.hermes
      - sluice-ca:/usr/local/share/ca-certificates/sluice:ro
    depends_on:
      tun2proxy:
        condition: service_healthy

  # Dashboard sidecar - shares hermes-home with the gateway and runs in
  # tun2proxy's network namespace so caddy can reach it at port 9119.
  # --insecure is required when binding non-loopback; caddy fronts the
  # TLS so the dashboard is not directly internet-facing.
  hermes-dashboard:
    image: nousresearch/hermes-agent:v2026.4.30
    restart: unless-stopped
    container_name: hermes-dashboard
    network_mode: "service:tun2proxy"
    entrypoint: ["/bin/sh", "-c", "exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"", "--"]
    command: ["dashboard", "--host", "0.0.0.0", "--port", "9119", "--no-open", "--insecure"]
    environment:
      - HOME=/opt/data
      - HERMES_HOME=/opt/data/.hermes
      - HERMES_UID=${HERMES_UID:-10000}
      - HERMES_GID=${HERMES_GID:-10000}
      - SSL_CERT_FILE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
      - REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
      - NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
    volumes:
      - hermes-home:/opt/data/.hermes
      - sluice-ca:/usr/local/share/ca-certificates/sluice:ro
    depends_on:
      hermes:
        condition: service_started

  # Reverse proxy for external HTTPS access to the Hermes dashboard.
  # Terminates TLS with an Origin certificate (TLS-provider agnostic;
  # standard FHS paths) and forwards to the dashboard in tun2proxy's
  # network namespace. This sidesteps the routing asymmetry that breaks
  # Docker's built-in port forwarding when tun2proxy's TUN device
  # captures reply packets.
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - /etc/ssl/certs/agent.pem:/etc/ssl/certs/agent.pem:ro
      - /etc/ssl/private/agent.key:/etc/ssl/private/agent.key:ro
    networks: [internal, external]
    depends_on:
      tun2proxy:
        condition: service_healthy

networks:
  internal:
    internal: true
    ipam:
      config:
        - subnet: 172.30.0.0/24
  external: {}

volumes:
  sluice-data:
  sluice-vault:
  sluice-audit:
  sluice-ca:
  hermes-home: