feat: expose hermes dashboard backend

The previous commit used `hbbs -R 192.168.1.69` (uppercase -R sets
rendezvous/cluster servers), so hbbs advertised an empty relay list and
clients failed with "failed to connect to relay server". Lowercase -r is
the relay-server flag; hbbs now advertises 192.168.1.69 and LAN clients
relay correctly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Caddyfile

@@ -360,6 +360,22 @@ homarr.ginnoir.com {
 	reverse_proxy homarr:7575
 }
 
+# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths
+# are passed through so Desktop clients can authenticate with the Hermes
+# dashboard session token instead of an Authentik browser cookie.
+hermes.ginnoir.com {
+	route {
+		import authentik_outpost
+		handle /api/* {
+			reverse_proxy 172.20.0.1:9119
+		}
+		handle {
+			import authentik_forward_auth
+			reverse_proxy 172.20.0.1:9119
+		}
+	}
+}
+
 backup.ginnoir.com {
 	route {
 		import authentik_outpost

stacks/remote/docker-compose.yml

@@ -18,7 +18,7 @@ services:
   hbbs:
     container_name: hbbs
     image: rustdesk/rustdesk-server:latest
-    command: hbbs
+    command: hbbs -r 192.168.1.69
     restart: unless-stopped
     env_file:
       - stack.env