feat: provision private Hermes assistants for authenticated Hope accounts

docker-compose.yml

@@ -1,33 +1,46 @@
 services:
+  control:
+    build:
+      context: .
+      dockerfile: control.Dockerfile
+    container_name: hope-control
+    network_mode: host
+    env_file: .env
+    environment:
+      CONTROL_DB_PATH: /var/lib/hope/accounts.sqlite3
+      CONTROL_HOST: 127.0.0.1
+      CONTROL_PORT: "8092"
+      HOPE_HERMES_DATA_DIR: "${HOPE_HERMES_DATA_DIR:?Set absolute Unraid Hermes data path}"
+      HERMES_IMAGE: "${HERMES_IMAGE:-nousresearch/hermes-agent@sha256:d4da4a40cd7a28aba983775d9fd31d94cbf153eeb0cb9e844d6d0f612b7c24db}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./accounts:/var/lib/hope
+      - "${HOPE_HERMES_DATA_DIR:?}:${HOPE_HERMES_DATA_DIR:?}"
+    restart: unless-stopped
+
   voice:
     build: .
     container_name: voice
     network_mode: host
     environment:
-      LIVEKIT_URL: "http://localhost:7880"
-      LIVEKIT_API_KEY: "${LIVEKIT_API_KEY:-devkey}"
-      LIVEKIT_API_SECRET: "${LIVEKIT_API_SECRET:-hopevoice-devsecret-2026-lan-only}"
-      AZURE_SPEECH_KEY: "${AZURE_SPEECH_KEY:?Set AZURE_SPEECH_KEY in .env}"
+      LIVEKIT_URL: http://localhost:7880
+      LIVEKIT_API_KEY: "${LIVEKIT_API_KEY:?Set LiveKit key}"
+      LIVEKIT_API_SECRET: "${LIVEKIT_API_SECRET:?Set LiveKit secret matching livekit.yaml}"
+      AZURE_SPEECH_KEY: "${AZURE_SPEECH_KEY:?Set Azure key}"
       AZURE_SPEECH_REGION: "${AZURE_SPEECH_REGION:-eastus}"
       AZURE_TTS_VOICE: "${AZURE_TTS_VOICE:-en-US-Ava:DragonHDOmniLatestNeural}"
-      LLM_BASE_URL: "${LLM_BASE_URL:-http://192.168.86.2:3005/api}"
-      LLM_MODEL: "${LLM_MODEL:-qwen2.5-vl-3b}"
-      LLM_API_KEY: "${LLM_API_KEY:-not-needed}"
-      WEB_MCP_ENABLED: "${WEB_MCP_ENABLED:-true}"
-      FIRECRAWL_BASE: "${FIRECRAWL_BASE:-http://192.168.86.2:3002}"
       WEB_PORT: "${WEB_PORT:-9178}"
-      VOICE_USERS_FILE: "/etc/hope/users.json"
-      VOICE_DEFAULT_USER: "${VOICE_DEFAULT_USER:-shane}"
-      MUSIC_BASE_URL: "${MUSIC_BASE_URL:-http://192.168.86.2:8094}"
-      MUSIC_ROOM: "${MUSIC_ROOM:-voice-room}"
+      CONTROL_URL: http://127.0.0.1:8092
+      CONTROL_SERVICE_SECRET: "${CONTROL_SERVICE_SECRET:?Set internal service secret}"
+      CONTROL_ALLOWED_ORIGINS: "${CONTROL_ALLOWED_ORIGINS:?Set HTTPS UI origins}"
     volumes:
-      - ./livekit.yaml:/etc/livekit.yaml:ro
+      - "${LIVEKIT_CONFIG_PATH:?Set private runtime LiveKit YAML}:/etc/livekit.yaml:ro"
       - ./certs:/etc/voice/certs
-      - ./skills:/skills
     healthcheck:
-      test: ["CMD-SHELL", "curl -sfk https://localhost:$${WEB_PORT:-9178}/ -o /dev/null && curl -sf http://localhost:7880/ -o /dev/null"]
+      test: [CMD, /opt/voice-agent/.venv/bin/python, /opt/voice-agent/healthcheck.py]
       interval: 15s
       timeout: 5s
       retries: 3
       start_period: 20s
+    depends_on: [control]
     restart: unless-stopped