Add OpenHands (agent-canvas) coding agent + Ollama backend

README.md

@@ -24,8 +24,10 @@ This is a real, running homelab — not a demo. It's deployed on a home Ubuntu s
 | **Filebrowser** | `filebrowser/` | Web-based file manager for the server's storage |
 | **Media stack** | `mediastack/` | Plex (media server), Sonarr/Radarr/Prowlarr (media automation and indexing), qBittorrent (download client) |
 | **Minecraft** | `minecraft/` | Self-hosted game server |
-| **Sentinel** | `sentinel/` | Disk health monitoring integrated  with smartctl  dump the outputs in the container logs  |
+| **Sentinel** | `sentinel/` | Disk health monitoring integrated with smartctl, dumps output to container logs |
 | **smartctl** | `smartctl/` | Disk health monitoring (S.M.A.R.T. data) |
+| **OpenHands** | `openhands/` | Self-hosted AI coding agent (OpenHands/agent-canvas) backed by Ollama — see [AI Coding Agent](docker-compose/docs/AI-Agent.md) |
+| **Nginx Proxy Manager** | `nginx-proxy-manager/` | Reverse proxy giving every service a friendly `.home` hostname with locally-trusted HTTPS — see [Reverse Proxy](docker-compose/docs/Reverse-Proxy.md) |
 
 ## Repository structure
 
@@ -59,6 +61,22 @@ homelab/
 │   └── docker-compose.yml
 ├── smartctl/
 │   └── docker-compose.yml
+├── openhands/
+│   └── docker-compose.yaml
+├── nginx-proxy-manager/
+│   └── docker-compose.yaml
+├── docs/
+│   ├── Home.md
+│   ├── Architecture-and-Hardware.md
+│   ├── Monitoring-Stack.md
+│   ├── Network-Services.md
+│   ├── Media-Automation.md
+│   ├── Workflow-Automation.md
+│   ├── Storage-Health.md
+│   ├── AI-Agent.md
+│   ├── Reverse-Proxy.md
+│   ├── Lessons-Learned.md
+│   └── images/
 └── .gitignore
 ```
 
@@ -76,12 +94,15 @@ docker compose up -d
 
 - All `.env` files, runtime config directories, and databases are excluded via `.gitignore` — only deployment definitions (`docker-compose.yml`) and `.env.example` placeholders are tracked.
 - Passwords referenced in compose files are injected via environment variables, never hardcoded.
+- The AI coding agent (`openhands/`) currently uses a third-party API aggregator as its LLM backend — see [AI Coding Agent](docker-compose/docs/AI-Agent.md) for details and caveats. It has no access to the Docker socket or other containers on the host.
 
 ## Lessons learned
 
 - Splitting each service into its own folder with its own Compose file made it much easier to reason about dependencies and update services independently, instead of one giant Compose file.
 - Runtime config/state (API keys, session tokens, library databases) needs to be gitignored at the directory level (`**/config/`, `**/data/`) — a plain text/secret grep alone isn't enough, since it silently skips over app-specific binary and XML config files.
 - Centralized monitoring (Prometheus + Grafana + cAdvisor + node-exporter) made it possible to actually see resource usage per container, which mattered a lot on lower-spec hardware.
+- Free-tier cloud AI APIs enforce regional access restrictions automatically — worth checking a provider's terms before building around "free tier" as an assumption. See [AI Coding Agent](docker-compose/docs/AI-Agent.md).
+- Wildcard TLS certs (`*.home`) are rejected by browsers on single-label local domains — certificates for local reverse proxies need explicit hostnames listed instead. See [Reverse Proxy](docker-compose/docs/Reverse-Proxy.md).
 
 ## Roadmap