refactor: move stack into hermes-stack/ subdir, clean root

hermes-stack/.env.example

@@ -0,0 +1,4 @@
+# Hermes Docker Stack — .env template
+# Copy to .env and fill in
+
+SEARXNG_SECRET_KEY=change_me_to_random_hex

hermes-stack/.gitignore

@@ -0,0 +1,20 @@
+# Environment
+.env
+!.env.example
+
+# Volume data
+volumes/searxng/data/
+volumes/camofox/browser/
+volumes/shared/
+!volumes/**/.gitkeep
+
+# Python
+__pycache__/
+*.pyc
+
+# Node
+node_modules/
+
+# OS
+.DS_Store
+Thumbs.db

hermes-stack/README.md

@@ -0,0 +1,64 @@
+# Hermes Docker Stack
+
+Self-hosted SearXNG (metasearch) + Camofox (browser) для Hermes Agent.
+
+## Структура
+
+```
+hermes-stack/              # ← самодостаточный проект
+├── compose/               # Production compose-файлы
+│   ├── searxng/           # SearXNG — self-hosted metasearch
+│   └── camofox/           # Camofox — anti-detection browser (Firefox)
+├── dev/                   # Dev-версии (другие порты)
+│   ├── searxng/
+│   └── camofox/
+├── volumes/               # Persistent volume data
+│   ├── searxng/config/    # settings.yml
+│   ├── searxng/data/
+│   ├── camofox/browser/   # Firefox profiles
+│   └── shared/
+├── src/camofox/           # Dockerfile для сборки Camofox
+├── scripts/manage.sh      # Управление стеком
+├── tests/
+├── .env                   # Секреты (gitignored)
+├── .env.example
+├── .gitignore
+└── README.md
+```
+
+## Порты
+
+| Сервис   | Prod | Dev  |
+|----------|------|------|
+| SearXNG  | 8964 | 8965 |
+| Camofox  | 9377 | 9378 |
+
+## Использование
+
+```bash
+cd hermes-stack
+./scripts/manage.sh start     # Запустить
+./scripts/manage.sh status    # Статус
+./scripts/manage.sh logs      # Логи
+./scripts/manage.sh stop      # Остановить
+./scripts/manage.sh dev       # Dev-режим
+```
+
+## Интеграция с Hermes
+
+В `~/.hermes/.env`:
+```
+SEARXNG_URL=http://localhost:8964
+CAMOFOX_URL=http://localhost:9377
+```
+
+В `~/.hermes/config.yaml`:
+```yaml
+web:
+  search_backend: searxng
+browser:
+  backend: camofox
+  camofox:
+    rewrite_loopback_urls: true
+    loopback_host_alias: host.docker.internal
+```

hermes-stack/compose/camofox/docker-compose.yml

@@ -0,0 +1,44 @@
+services:
+  camofox:
+    build: ../../src/camofox
+    container_name: hermes-camofox
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:9377:9377"
+    networks:
+      - hermes-net
+    environment:
+      - CAMOFOX_PORT=9377
+      - CAMOFOX_REWRITE_LOOPBACK_URLS=true
+      - CAMOFOX_LOOPBACK_HOST_ALIAS=host.docker.internal
+    volumes:
+      - ../../volumes/camofox/browser:/home/browser/.camoufox:rw
+      - ../../volumes/shared:/shared:rw
+    cap_drop:
+      - ALL
+    cap_add:
+      - SYS_ADMIN
+      - NET_ADMIN
+      - NET_RAW
+      - CHOWN
+      - SETGID
+      - SETUID
+      - DAC_OVERRIDE
+      - FOWNER
+    shm_size: 2gb
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: 3
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:9377/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+networks:
+  hermes-net:
+    name: hermes-net
+    driver: bridge

hermes-stack/compose/searxng/docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  searxng:
+    image: searxng/searxng:latest
+    container_name: hermes-searxng
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8964:8080"
+    networks:
+      - hermes-net
+    volumes:
+      - ../../volumes/searxng/config:/etc/searxng:rw
+      - ../../volumes/searxng/data:/etc/searxng/data:rw
+    environment:
+      - SEARXNG_BASE_URL=http://localhost:8964/
+      - SEARXNG_SECRET_KEY=${SEARXNG_SECRET_KEY:?err}
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+      - DAC_OVERRIDE
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: 3
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+networks:
+  hermes-net:
+    name: hermes-net
+    driver: bridge

hermes-stack/dev/camofox/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  camofox:
+    extends:
+      file: ../../compose/camofox/docker-compose.yml
+      service: camofox
+    container_name: hermes-camofox-dev
+    ports:
+      - "127.0.0.1:9378:9377"
+
+networks:
+  hermes-net:
+    name: hermes-net
+    driver: bridge

hermes-stack/dev/searxng/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  searxng:
+    extends:
+      file: ../../compose/searxng/docker-compose.yml
+      service: searxng
+    container_name: hermes-searxng-dev
+    ports:
+      - "127.0.0.1:8965:8080"
+    environment:
+      - SEARXNG_BASE_URL=http://localhost:8965/
+
+networks:
+  hermes-net:
+    name: hermes-net
+    driver: bridge

hermes-stack/scripts/manage.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Hermes Docker Stack — manage script
+set -euo pipefail
+DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$DIR"
+
+case "${1:-status}" in
+  start)
+    echo "🚀 Starting Hermes Docker Stack..."
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml up -d
+    echo "SearXNG: http://localhost:8964"
+    echo "Camofox: http://localhost:9377"
+    ;;
+  stop)
+    echo "🛑 Stopping..."
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml down
+    ;;
+  restart)
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml down
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml up -d
+    ;;
+  status)
+    echo "=== Hermes Docker Stack ==="
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml ps
+    echo "---"
+    for url in http://localhost:8964/ http://localhost:9377/health; do
+      code=$(curl -s -o /dev/null -w '%{http_code}' "$url" 2>/dev/null || echo "down")
+      echo "$url → $code"
+    done
+    ;;
+  logs)
+    docker compose -f compose/searxng/docker-compose.yml -f compose/camofox/docker-compose.yml logs --tail=50 -f
+    ;;
+  dev)
+    echo "🧪 Starting DEV stack..."
+    docker compose -f dev/searxng/docker-compose.yml -f dev/camofox/docker-compose.yml up -d
+    echo "SearXNG: http://localhost:8965"
+    echo "Camofox: http://localhost:9378"
+    ;;
+  dev-stop)
+    docker compose -f dev/searxng/docker-compose.yml -f dev/camofox/docker-compose.yml down
+    ;;
+  *)
+    echo "Usage: $0 [start|stop|restart|status|logs|dev|dev-stop]"
+    exit 1
+    ;;
+esac

hermes-stack/src/camofox/Dockerfile

@@ -0,0 +1,17 @@
+FROM node:22-alpine
+
+RUN apk add --no-cache \
+    nss freetype freetype-dev harfbuzz ca-certificates ttf-freefont \
+    libstdc++ dbus-glib xvfb xauth wget curl yt-dlp
+
+RUN npm install -g @askjo/camofox-browser@1.13.1
+RUN npx playwright install firefox
+
+EXPOSE 9377
+
+ENV CAMOFOX_PORT=9377
+ENV CAMOFOX_REWRITE_LOOPBACK_URLS=true
+ENV CAMOFOX_LOOPBACK_HOST_ALIAS=host.docker.internal
+ENV DISPLAY=:99
+
+CMD Xvfb :99 -screen 0 1920x1080x24 & sleep 0.5 && camofox-browser

hermes-stack/volumes/searxng/config/settings.yml

@@ -0,0 +1,48 @@
+# SearXNG settings — Hermes Agent instance
+# Port 8964 (internal 8080)
+# See: https://docs.searxng.org/admin/settings/settings.yml.html
+
+use_default_settings: true
+
+general:
+  instance_name: "Hermes SearXNG"
+  debug: false
+  privacypolicy_url: false
+  contact_url: false
+  enable_metrics: false
+
+search:
+  safe_search: 0
+  autocomplete: ""
+  default_lang: ""
+  formats:
+    - html
+    - json
+
+server:
+  secret_key: ""  # overridden by SEARXNG_SECRET_KEY env
+  bind_address: "0.0.0.0"
+  port: 8080
+  base_url: "http://localhost:8964/"
+  limiter: false
+  image_proxy: false
+  method: "GET"
+
+ui:
+  static_use_hash: true
+  default_theme: simple
+  default_locale: ""
+
+outgoing:
+  request_timeout: 10.0
+  max_request_timeout: 15.0
+  useragent_suffix: ""
+  verify: true
+
+enabled_plugins:
+  - BasicPlugin
+  - DictPlugin
+  - HeaderPlugin
+  - SearchSuggestionsPlugin
+  - SelfInformationPlugin
+  - TrackerUrlPlugin