Docker Compose 部署 Hermes Agent

现有简略版

services:
  gateway:
    image: nousresearch/hermes-agent:latest
    container_name: hermes
    restart: unless-stopped
    volumes:
      - ./data:/opt/data
    environment:
      - HERMES_UID=${HERMES_UID:-10000}
      - HERMES_GID=${HERMES_GID:-10000}
      - TZ=Asia/Shanghai
    command: ["gateway", "run"]

带后台面板完整版

services:
  gateway:
    image: nousresearch/hermes-agent:latest
    container_name: hermes-gateway
    restart: unless-stopped
    volumes:
      # 前后端容器必须挂载相同的宿主机目录，作为统一的数据源 (SSOT)
      - ./data:/opt/data
    environment:
      # 映射权限，确保容器内部进程对挂载的数据卷拥有读写权限
      - HERMES_UID=${HERMES_UID:-10000}
      - HERMES_GID=${HERMES_GID:-10000}
      - TZ=Asia/Shanghai
    # 执行网关核心进程
    command: ["gateway", "run"]

  dashboard:
    image: nousresearch/hermes-agent:latest
    container_name: hermes-dashboard
    restart: unless-stopped
    depends_on:
      # 依赖控制，确保在网关启动后再拉起前端面板
      - gateway
    volumes:
      # 必须与 gateway 保持完全一致的挂载路径
      - ./data:/opt/data
    ports:
      # 将宿主机的 9119 端口映射至容器内部的 9119 端口
      # 限制 127.0.0.1 可阻断公网直连，后续通过宿主机反向代理 (如 1Panel 的 OpenResty) 访问
      - "127.0.0.1:59118:9119"
    environment:
      - HERMES_UID=${HERMES_UID:-10000}
      - HERMES_GID=${HERMES_GID:-10000}
      - TZ=Asia/Shanghai
      # Dashboard 的 HTTP Basic 身份验证配置
      - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin
      - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=admin
    # 覆盖默认命令，拉起前端面板
    # 容器内部必须监听 0.0.0.0，以便 Docker Bridge 网络能够正常转发外部请求
    command: ["dashboard", "--host", "0.0.0.0", "--no-open"]