feat: provision private Hermes assistants for authenticated Hope accounts

.gitea/workflows/rebuild.yml

@@ -1,64 +1,26 @@
 name: Rebuild & Deploy
-
 on:
   push:
     branches: [master]
-    paths-ignore:
-      - '*.md'
-
+    paths-ignore: ['*.md']
 jobs:
   rebuild:
     runs-on: unraid
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Build image
-        run: docker build -t hope-voice-api-voice:latest .
-
-      - name: Restart container
-        env:
-          AZURE_SPEECH_KEY: ${{ secrets.AZURE_SPEECH_KEY }}
+      - name: Build images
         run: |
-          docker stop voice 2>/dev/null || true
-          docker rm voice 2>/dev/null || true
-          docker run -d \
-            --name voice \
-            --network host \
-            --restart unless-stopped \
-            --health-cmd='curl -sfk https://localhost:${WEB_PORT:-9178}/ -o /dev/null && curl -sf http://localhost:7880/ -o /dev/null' \
-            --health-interval=15s \
-            --health-timeout=5s \
-            --health-retries=3 \
-            --health-start-period=20s \
-            -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs \
-            -v /mnt/user/dev/hope-voice-api/skills:/skills \
-            -v /mnt/user/dev/hope-voice-api/livekit.yaml:/etc/livekit.yaml:ro \
-            -e LIVEKIT_URL=http://localhost:7880 \
-            -e LIVEKIT_API_KEY=devkey \
-            -e LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only \
-            -e AZURE_SPEECH_KEY="$AZURE_SPEECH_KEY" \
-            -e AZURE_SPEECH_REGION=eastus \
-            -e AZURE_TTS_VOICE=en-US-Ava:DragonHDOmniLatestNeural \
-            -e LLM_BASE_URL=http://192.168.86.2:3005/api \
-            -e LLM_MODEL=qwen2.5-vl-3b \
-            -e LLM_API_KEY=sk-4e9259e3bd56472db57fd40adf0fe567 \
-            -e WEB_MCP_ENABLED=true \
-            -e FIRECRAWL_BASE=http://192.168.86.2:3002 \
-            -e WEB_PORT=9178 \
-            -e VOICE_USERS_FILE=/etc/hope/users.json \
-            -e VOICE_DEFAULT_USER=shane \
-            -e MUSIC_BASE_URL=http://192.168.86.2:8094 \
-            -e MUSIC_ROOM=voice-room \
-            hope-voice-api-voice:latest
-
-      - name: Verify deployment
+          docker build -t hope-voice-api-voice:latest .
+          docker build -f control.Dockerfile -t hope-voice-control:latest .
+      - name: Deploy using protected persistent runtime configuration
         run: |
-          for attempt in $(seq 1 12); do
-            if [ "$(docker inspect --format='{{.State.Health.Status}}' voice 2>/dev/null)" = "healthy" ]; then
-              exit 0
-            fi
-            sleep 5
-          done
-          docker logs voice
-          exit 1
+          # Credentials, account DB, certificates and per-user homes are outside
+          # the CI checkout. This script never destroys or reinitializes them.
+          test -f /mnt/user/appdata/hope-voice/runtime.env
+          bash scripts/deploy-unraid.sh
+      - name: Verify authenticated deployment
+        run: |
+          curl -sf http://127.0.0.1:8092/health -o /dev/null
+          curl -sfk https://127.0.0.1:9178/ -o /dev/null
+          test "$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401