Skip to content

fix: stop dashboard restart loop and harden default API server key #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
santteegt wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: stop dashboard restart loop and harden default API server key #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,25 @@ services:
API_SERVER_ENABLED: "true"
API_SERVER_PORT: "3000"
API_SERVER_HOST: 0.0.0.0
API_SERVER_KEY: dappnode
# Must be 16+ chars and not a known placeholder — upstream now refuses
# to start the API server (terminal-capable agent dispatch) with a
# weak/guessable key, even on loopback binds.
API_SERVER_KEY: "e128aa3f5120f9ebbb83488241b6698423914c575826fbfb4542bfdc65954f2e"
API_SERVER_CORS_ORIGINS: "*"
GATEWAY_ALLOW_ALL_USERS: "true"
# Enable the upstream s6 dashboard service on the DAppNode port (8081).
HERMES_DASHBOARD: "true"
HERMES_DASHBOARD_HOST: 0.0.0.0
HERMES_DASHBOARD_PORT: "8081"
HERMES_DASHBOARD_INSECURE: "true"
# Non-loopback binds require a registered auth provider (upstream fail-closed
# hardening, June 2026) — HERMES_DASHBOARD_INSECURE no longer bypasses this.
# Use the bundled username/password provider with the same static-credential
# convention as API_SERVER_KEY above; the actual trust boundary is the
# DAppNode private network / VPN, not this credential.
HERMES_DASHBOARD_BASIC_AUTH_USERNAME: dappnode
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD: dappnode
HERMES_DASHBOARD_BASIC_AUTH_SECRET: "UKJuFVZecdpgo1ZdqBojtM8ujvEVDxLSS7sIGtY1E4Y="
HERMES_DASHBOARD_BASIC_AUTH_TTL_SECONDS: "2592000"
volumes:
- hermes_data:/opt/data
logging:
Expand Down
2 changes: 1 addition & 1 deletion getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,4 @@ A **self-hosted AI agent** by [Nous Research](https://nousresearch.com) that run

1. **Set up a provider** — Open the [Setup Wizard](http://hermes-agent.dappnode:8080) and pick an AI provider.
2. **Talk to Hermes** — Message your bot on Telegram/Discord, run `hermes chat` in the [Web Terminal](http://hermes-agent.dappnode:7681), or connect any OpenAI-compatible client to `http://hermes-agent.dappnode:3000`.
3. **Manage your agent** — The [Dashboard](http://hermes-agent.dappnode:8081) lets you view sessions, manage API keys, configure skills, set up scheduled tasks, and check logs.
3. **Manage your agent** — Open the [Dashboard](http://hermes-agent.dappnode:8081) (login: `dappnode` / `dappnode`) to view sessions, manage API keys, configure skills, set up scheduled tasks, and check logs. Change the credentials via the `HERMES_DASHBOARD_BASIC_AUTH_USERNAME`/`_PASSWORD` environment variables (or `dashboard.basic_auth` in `config.yaml`) if you want a private login.