feat: add openclaw and hermes agent templates

hermes/.env.example

@@ -0,0 +1,15 @@
+# Copy to .env and fill in. Never commit .env.
+#
+#   cp .env.example .env
+
+# Web UI login password.
+# Generate one with: openssl rand -base64 24
+HERMES_WEBUI_PASSWORD=
+
+# Model provider for the agent.
+OPENROUTER_API_KEY=
+
+# Other providers. Uncomment here and in compose.yml to enable one.
+# ANTHROPIC_API_KEY=
+# OPENAI_API_KEY=
+# GOOGLE_API_KEY=

hermes/README.md

@@ -0,0 +1,52 @@
+# hermes
+
+[Hermes Agent](https://github.com/NousResearch/hermes-agent), an autonomous AI
+agent with persistent memory and scheduling, behind
+[Hermes WebUI](https://github.com/nesquena/hermes-webui), a self-hosted web
+chat for it.
+
+Two containers: `hermes-agent` runs the agent gateway, and `hermes-webui`
+serves the chat on port `8787`.
+
+## Setup
+
+1. Set `HERMES_WEBUI_PASSWORD` and `OPENROUTER_API_KEY`.
+2. Map the domain to the `hermes-webui` container on port `8787` and deploy.
+3. Open the domain and log in with `HERMES_WEBUI_PASSWORD`.
+
+Health check: `GET /health` on the web UI, also its compose healthcheck.
+
+## Environment
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `HERMES_WEBUI_PASSWORD` | — | Web UI login |
+| `OPENROUTER_API_KEY` | empty | Model provider |
+| `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY` | optional | Other model providers |
+
+`HERMES_WEBUI_PASSWORD` is required: without it the chat, and the agent
+behind it, are open to anyone who reaches the domain.
+
+The uid/gid pairs are pinned to `1000` in `compose.yml`. Both containers write
+the shared `hermes-home` volume, so both must run as the same user.
+
+## Storage
+
+| Volume | Mount | Holds |
+| --- | --- | --- |
+| `hermes-home` | `/home/hermes/.hermes` (agent), `/home/hermeswebui/.hermes` (web UI) | Agent config, memory, skills and sessions; web UI state in `webui/` |
+| `hermes-agent-src` | `/opt/hermes` (agent), `.hermes/hermes-agent`, read-only (web UI) | The agent's source code, which the web UI imports |
+| `hermes-workspace` | `/workspace` (web UI) | Files the agent works on |
+
+### Updating the agent
+
+`hermes-agent-src` is filled from the agent image only when the volume is
+first created. A newer `latest` image therefore keeps running the old source
+until the volume is removed, which upstream documents as the upgrade step:
+stop the app, delete the `hermes-agent-src` volume, and deploy again. Nothing
+else lives in that volume.
+
+## Images
+
+Both images use `latest`. Upstream recommends moving the two together, since
+the web UI imports the agent's source and is built against matching versions.

hermes/compose.yml

@@ -0,0 +1,49 @@
+services:
+  hermes-agent:
+    image: nousresearch/hermes-agent:latest
+    restart: unless-stopped
+    command: gateway run
+    environment:
+      - HERMES_HOME=/home/hermes/.hermes
+      - HERMES_UID=1000
+      - HERMES_GID=1000
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
+      # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+      # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      # - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}
+    volumes:
+      - hermes-home:/home/hermes/.hermes
+      - hermes-agent-src:/opt/hermes
+    healthcheck:
+      test: ["CMD-SHELL", "test -d /home/hermes/.hermes || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # Web chat UI, sharing the agent's home and source.
+  hermes-webui:
+    image: ghcr.io/nesquena/hermes-webui:latest
+    restart: unless-stopped
+    depends_on:
+      - hermes-agent
+    environment:
+      - HERMES_WEBUI_PASSWORD=${HERMES_WEBUI_PASSWORD:?required}
+      - WANTED_UID=1000
+      - WANTED_GID=1000
+      - HERMES_WEBUI_HOST=0.0.0.0
+      - HERMES_WEBUI_PORT=8787
+      - HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui
+    volumes:
+      - hermes-home:/home/hermeswebui/.hermes
+      - hermes-agent-src:/home/hermeswebui/.hermes/hermes-agent:ro
+      - hermes-workspace:/workspace
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8787/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  hermes-home:
+  hermes-agent-src:
+  hermes-workspace: