Add container templates (ct/) and install scripts (install/) plus metadata JSON entries for BunkerM, Colanode, Edit-Mind, and ExcaliDash. Each app includes an LXC template script with update routines, a corresponding installer that provisions dependencies, builds the app, configures services (systemd/nginx/supervisor), and example default environment/config. JSON metadata files register interface ports, recommended resources, documentation/website links, and notes for each app.
hermes-agent v2026.5.7 (PR #21193, merged 2026-05-07) flipped
HERMES_REDACT_SECRETS and DEFAULT_CONFIG security.redact_secrets to
true by default. The explicit HERMES_REDACT_SECRETS=true in .env and
the config.yaml creation block added in commit 1420682e are now
redundant — Hermes writes the same values itself on a fresh install.
Verified on CT 900 (v2026.5.7): _REDACT_ENABLED=True with no env
override; Hermes self-writes redact_secrets: true to config.yaml.
Ref: NousResearch/hermes-agent#17691
Adds third-party script warning with user confirmation before running
the upstream installer (install) and updater (update), matching the
kasm/pihole pattern. Removes redundant binary existence check per
reviewer feedback. Adds corresponding JSON warning note.
Trims the verbose 12-line CT footer to the standard pattern plus
essential first-run setup steps. API server, API key, and dashboard
SSH tunnel details are now displayed on every SSH login via
/etc/profile.d/hermes-hint.sh instead.
Addresses PR feedback from CrazyWolf13.
Increase Stoatchat default RAM from 8192 to 10240 in ct/stoatchat.sh and json/stoatchat.json. Add cargo -j 2 to backend builds in ct/stoatchat.sh and install/stoatchat-install.sh to limit parallel jobs. Remove two environment variables (XYOPS_xysat_local and XYOPS_masters) from install/xyops-install.sh service definition to avoid hardcoded local settings.
Introduce new container templates, installers, and metadata for Stoatchat and xyOps. Adds ct scripts (ct/stoatchat.sh, ct/xyops.sh), full install scripts (install/stoatchat-install.sh, install/xyops-install.sh) that provision dependencies, build components, and create systemd services, plus app metadata JSON (json/stoatchat.json, json/xyops.json). Stoatchat installer handles Rust backend build, SolidJS frontend build, MinIO, RabbitMQ, MongoDB, nginx reverse proxy and multiple backend services (exposes on port 80). xyOps installer builds the Node app, sets up the xySat satellite, service unit, and uses port 5522 for the web UI. Default resource recommendations and notes are included in the JSON metadata.
Modernize and simplify VM installer and lobehub installation flows.
Key changes:
- install/lobehub-install.sh: consolidated apt invocation, replaced manual ParadeDB .deb download with fetch_and_deploy_gh_release helper, added postgresql pg_search preload configuration and restart, moved pnpm installation into setup_nodejs via NODE_MODULE, and adjusted build env handling.
- vm/almalinux-10-vm.sh: major refactor to source shared functions from COMMUNITY_SCRIPTS_URL, add load_functions, centralize cloud-init handling (configure_cloudinit_ssh_keys / setup_cloud_init), replace many custom UI/helper functions with standardized helpers and exit_script, update traps and error handling, simplify prompts/defaults, use $STD for apt operations, and streamline image customization and VM creation flow.
- Added vm/headers/almalinux-10-vm containing the VM header art and title.
These changes centralize common logic, improve cloud-init integration, reduce duplicated code, and make maintenance easier.
The previous approach used a /usr/bin/hermes shim to proxy commands from root
to the hermes user, and a hand-crafted system-level systemd unit for the
gateway. This worked for the default profile but broke down for named profiles:
- hermes profile create <name> generates an alias script in
~/.local/bin/<name> that calls hermes with -p <name>. These aliases live
in the hermes user's PATH, not root's, so root could not invoke them.
- Maintaining parity would require per-profile shims, a watcher daemon to
create/remove them, and system-unit mirrors for each profile gateway — all
of which would need to stay in sync with hermes internals across updates.
New approach — work with hermes, not around it:
- loginctl enable-linger hermes: ensures the hermes user's systemd session
starts at boot and persists without login. All user-unit gateways (default
and per-profile) now survive reboots automatically.
- Gateway service management delegated entirely to hermes: 'hermes gateway
install' / 'hermes setup' create and enable the user unit natively.
The install script no longer pre-installs the gateway; hermes prompts the
user to do so at the end of 'hermes setup'.
- hermes-dashboard.service remains a system unit (no native install command
exists for it). Its After= no longer references hermes-gateway.service
since there is no system-unit gateway to depend on.
- /usr/bin/hermes shim removed. Root is guided to 'su - hermes' via a two-
line /etc/profile.d/hermes-hint.sh message on login, with a one-liner to
make the switch automatic. Once logged in as hermes, all hermes commands,
profile aliases, and gateway management work natively.
- update_script simplified: only hermes-dashboard (our unit) is stopped and
restarted. hermes update --yes handles gateway service lifecycle itself.
