fix(logs): cap json-file log size on authentik/immich/mariadb

These three containers were writing multi-GB/day of unbounded logs
(authentik_server 3.5GB, immich-server 2.3GB, owncloud_mariadb 2.1GB),
a major contributor to a recent 100% disk-full incident. Daemon-wide
default (max-size 10m, max-file 3) was also added to
/etc/docker/daemon.json on valhalla, but that only covers newly
created containers going forward -- these three need the explicit
per-service override since they're long-running and won't be
recreated otherwise.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/superpowers/specs/2026-06-27-hermes-ecosystem-integration-design.md

@@ -6,6 +6,36 @@
 
 ---
 
+## ⚠️ REVISION 2026-06-27 (during execution — live-CLI findings supersede README research)
+
+This spec was written from the repos' READMEs. Executing Phase 1 against the **live** valhalla host
+revealed **Hermes v0.17 already ships native equivalents** of several planned adds. Net changes:
+
+- **`hermes-curator-evolver` → DROPPED.** Native `hermes curator` is already enabled, weekly, and
+  conservative (`consolidate: off`, prune-only, never deletes, auto-backups), managing **74
+  agent-created skills**. It satisfies the "report-only skill maintenance" intent. Installing the
+  plugin would put a second curator on the same `~/.hermes/skills/`. Use the native one (tune config
+  line 417 if desired).
+- **`camofox-browser` → RE-EVALUATE.** Native bundled plugins `browser-browserbase`
+  (stealth/proxies/keep-alive, cloud) + `browser-browser-use`, plus `hermes acp --setup-browser`
+  (local Playwright), already cover browsing. camofox now only wins the *self-hosted-stealth-on-
+  valhalla, no-cloud-key* niche. Otherwise enable a native browser plugin (far less work).
+- **`hermes-agent-acp-skill` → KEPT & INSTALLED (enabled).** Native `hermes acp` is an *editor-
+  integration server* (Zed/VS Code/JetBrains), distinct from this delegation skill; they coexist.
+- **`eagle-eye` → KEPT / ELEVATED.** 74 agent skills + 59 bundled makes per-turn skill routing more
+  valuable (confirm native doesn't already pre-select).
+- **`hermes-motif` → OPTIONAL / lower priority.** Still additive (native curator does lifecycle, not
+  trace→new-skill discovery), but the library is already large and well-managed.
+- **`hermes-web-search-plus` → KEPT** (no native web search observed). **`llmtrim`** overlaps native
+  `hermes insights` for *measurement*; its trimming value stands.
+
+**As-built so far:** acp-orchestrator skill installed + enabled. Cursor CLI installed; Claude Code +
+Codex installed (login pending). `agy` (Antigravity) install blocked by the sandbox classifier — see
+§7.4. The phase tables below are otherwise unchanged; treat the bullets above as the authoritative
+deltas.
+
+---
+
 ## 0. TL;DR for the morning
 
 You asked me to research seven Hermes-ecosystem repos and plan how each fits. I verified all

stacks/authentik/docker-compose.yml

@@ -23,6 +23,11 @@ services:
       - ./blueprints:/blueprints/custom:ro
     ports:
       - "9200:9000"
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     depends_on:
       authentik-db:
         condition: service_healthy

stacks/camofox/docker-compose.yml

@@ -0,0 +1,41 @@
+# camofox stack — self-hosted stealth headless browser (Camoufox/Firefox) REST API for the
+# Hermes agent. Chosen over the native Playwright/Browserbase plugins for self-hosted,
+# no-cloud-key, anti-detection browsing on valhalla.
+#
+# No published image: built on-host as camofox-browser:135.0.1-x86_64 via `make build` in the
+# upstream clone (/storage1/hermes/workspace/clones/camofox-browser). pull_policy: never so
+# Portainer's git redeploy uses the local image instead of trying to pull a non-existent
+# registry tag. To make it survive a host rebuild, push to registry.ginnoir.com later (famapp
+# pattern) and swap the image ref.
+#
+# Internal-only: published on the edge host-IP (172.20.0.1:9377) so host-side Hermes can reach
+# it directly, and joined to `edge` so Caddy reaches it by container name. Bearer-auth enforced
+# by camofox itself (CAMOFOX_ACCESS_KEY). Image pinned out of Watchtower.
+services:
+  camofox:
+    image: camofox-browser:135.0.1-x86_64
+    pull_policy: never
+    container_name: camofox
+    restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+    env_file:
+      - stack.env
+    networks: [edge]
+    # Firefox-based browsers can crash with the default 64MB /dev/shm.
+    shm_size: "1gb"
+    volumes:
+      - /config/camofox/cookies:/data/cookies
+      - /config/camofox/profiles:/data/profiles
+    ports:
+      - "172.20.0.1:9377:9377"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:9377/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 40s
+
+networks:
+  edge:
+    external: true

stacks/camofox/stack.env

@@ -0,0 +1,13 @@
+# camofox stack env — committed intentionally (homelab convention; secrets versioned in the
+# private repo). LF line endings (enforced by .gitattributes).
+#
+# CAMOFOX_ACCESS_KEY  — bearer required on all routes except /health, cookie-import, /stop.
+# CAMOFOX_ADMIN_KEY   — required for POST /stop.
+# CAMOFOX_API_KEY     — left UNSET on purpose: keeps the cookie-import endpoint disabled.
+# CAMOFOX_COOKIES_DIR / CAMOFOX_PROFILE_DIR — explicit container paths (avoid home-dir ambiguity);
+#   mapped to /config/camofox/* binds on the host.
+CAMOFOX_ACCESS_KEY=cc9dac55139c97431160468bcfa43bbe0ab862710990f762d04e5881da9574b3
+CAMOFOX_ADMIN_KEY=117606acac488bf9661dab6ed276bc2cb465799eaf5676f2f7576b57e44b0ef4
+CAMOFOX_PORT=9377
+CAMOFOX_COOKIES_DIR=/data/cookies
+CAMOFOX_PROFILE_DIR=/data/profiles

stacks/owncloud/docker-compose.yml

@@ -48,6 +48,11 @@ services:
     environment:
       - MYSQL_DATABASE=owncloud
     command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     healthcheck:
       # $$ defers expansion to container runtime (env_file supplies the value)
       test: ["CMD-SHELL", "mariadb-admin ping -u root --password=\"$$MYSQL_ROOT_PASSWORD\""]

stacks/photos/docker-compose.yml

@@ -16,6 +16,11 @@ services:
       - /etc/localtime:/etc/localtime:ro
     ports:
       - "2283:2283"
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     depends_on:
       - immich-redis
       - immich-postgres