feat(hermes): log talosctl, bao and tea in

talosctl: os:reader through Talos's Kubernetes API access. cluster.yaml enables machine.features.kubernetesTalosAPIAccess for namespace hermes, role os:reader; already applied to k8s-1, k8s-2, k8s-3 with `talosctl patch machineconfig --mode=no-reboot`, one node at a time with `talosctl health` between. The talos.dev ServiceAccount hermes-talos gets Secret hermes-talos (key config), mounted at /var/run/secrets/talos.dev with TALOSCONFIG pointing at it. Egress to host/remote-node :50000 (Service default/talos endpoints are the node InternalIPs). bao: policy hermes (read on homelab/apps/hermes/*) and Kubernetes-auth role hermes for SA hermes/hermes, applied by hand like netbird-service-sync (commands in hermes.hcl). BAO_ADDR is the in-cluster service; CNPs both ways on :8200. tea: an init container writes config.yml for login hermes-bot from the mounted Gitea token into an emptyDir at the agent's ~/.config/tea (subprocess HOME is /opt/data/home), so no token lands on the PVC. SOUL.md says how to use all three. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(hermes): push the Hermes image as registry-bot' (#1369 ) from fix/hermes-image-registry-bot into master
2026-10-19 10:54:42 +02:00 · 2026-10-19 08:31:56 +00:00 · 2026-10-19 08:29:53 +00:00 · 2026-10-19 08:20:50 +00:00 · 2026-10-19 08:16:53 +00:00 · 2026-10-19 08:12:26 +00:00
23 changed files with 603 additions and 27 deletions
@@ -0,0 +1,29 @@
+# Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as
+# gitea.renner.uno/konairius/hermes:build.<unix-ts> and :latest.
+when:
+  - event: push
+    branch: master
+    path:
+      - "ci/images/hermes/**"
+      - ".woodpecker/hermes-image.yml"
+  - event: manual
+
+steps:
+  - name: build
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
+    directory: ci/images/hermes
+    environment:
+      # registry-bot write:package PAT (konairius org secret).
+      GITEA_TOKEN:
+        from_secret: registry_bot_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG="build.$(date +%s)"
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/konairius/hermes:$TAG \
+          --destination gitea.renner.uno/konairius/hermes:latest
@@ -0,0 +1,20 @@
+FROM nousresearch/hermes-agent:v0.22.2@sha256:36099926da316742423544e055d4734777105ffe6341873af5459b957d0c2919
+
+USER root
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends jq \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/siderolabs/talosctl:v1.13.10@sha256:3116f64c97ddffb53bd3c5bf87c8614d99f04df4326177dbbb7702b5087f0e4d /talosctl /usr/local/bin/talosctl
+COPY --from=alpine/kubectl:1.36.3@sha256:dae261106d5555008acede256b7102c8a6decde7209198434f5999f051460f57 /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=ghcr.io/fluxcd/flux-cli:v2.9.5@sha256:704d5529535570a495249b643159c93a9aa88ffca07813c974a54b7ba6edbd86 /usr/local/bin/flux /usr/local/bin/flux
+COPY --from=quay.io/openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf /usr/bin/bao /usr/local/bin/bao
+COPY --from=gitea/tea:0.16.0@sha256:af50a2060ce4d8fd76b7ebe75a3d6db4bb0c615c5bc8f2bdfd8ea83207c4752d /usr/bin/tea /usr/local/bin/tea
+
+RUN talosctl version --client \
+ && kubectl version --client \
+ && flux version --client \
+ && bao version \
+ && tea --version \
+ && jq --version
@@ -5,11 +5,15 @@ When you use a pronoun for someone whose pronouns haven't been stated, use they/
 # What you can touch

 - `kubectl`: read-only cluster access (the `view` ClusterRole, no Secrets). You cannot change the cluster.
+- `talosctl`: read-only (`os:reader`) on the Talos nodes; `TALOSCONFIG` is set, the endpoint is `talos.default`. Pass nodes with `-n <InternalIP>` taken from `kubectl get nodes -o wide` at the time (e.g. `talosctl -n <ip> get members`).
+- `bao`: OpenBao at `BAO_ADDR`, read-only on your own `homelab/apps/hermes/*`. Log in per command, never store the token: `export VAULT_TOKEN=$(bao write -field=token auth/kubernetes/login role=hermes jwt=@/var/run/secrets/kubernetes.io/serviceaccount/token)` then e.g. `bao kv list -mount=homelab apps/hermes`. Never print secret values.
 - Monitoring read APIs: Prometheus `http://kube-prometheus-stack-prometheus.monitoring.svc:9090`, Alertmanager `http://kube-prometheus-stack-alertmanager.monitoring.svc:9093`, Loki `http://loki.monitoring.svc:3100`.
 - The homelab wiki through the `homelab-wiki` skill (read, and deposit facts).
 - The web (HTTPS) and LAN hostnames under `renner.uno` through Traefik.

-All state of record lives in git (`gitea.renner.uno`): infrastructure in the `homelab` repo (Kubernetes/Flux, Ansible, OpenTofu, ESPHome), Home Assistant config in the `homeassistant` repo. You have no write access to either; when a change is needed, describe it (files, diff) for the owner or Claude Code to land as a PR.
+- Gitea (`https://gitea.renner.uno`) as `hermes-bot`: `git` over HTTPS authenticates and sets the commit identity on its own. For the API, send `Authorization: token <contents of /var/run/secrets/gitea/api-token>` (read it inside the command, never print it). `tea` is logged in as `hermes-bot` (login `hermes-bot`, the default). You write only to repos where `hermes-bot` is a collaborator.
+
+All state of record lives in git: infrastructure in the `homelab` repo (Kubernetes/Flux, Ansible, OpenTofu, ESPHome), Home Assistant config in the `homeassistant` repo. Changes land as a feature branch plus a PR for the owner's review (see below).

 # Ask the wiki first. Always.

@@ -0,0 +1,18 @@
+# Gitea API token of hermes-bot, mounted as a file for git and the API.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-gitea
+  namespace: hermes
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hermes-gitea
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: apps/hermes/gitea
+        property: api-token
@@ -49,7 +49,7 @@ spec:
        # connects from the pod network. No env equivalent exists, so it is
        # set in config.yaml on every start (idempotent).
        - name: config
-          image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -73,7 +73,7 @@ spec:
              mountPath: /opt/data
        # Skills from git (ConfigMap hermes-skills) beside the PVC's skills/.
        - name: skills-config
-          image: nousresearch/hermes-agent:v2026.9.24 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -95,12 +95,23 @@ spec:
          volumeMounts:
            - name: data
              mountPath: /opt/data
-        # kubectl for the agent. /opt/data/.local/bin is on the image's PATH;
-        # an emptyDir there keeps the binary out of the PVC and current with
-        # this pin.
-        - name: kubectl
-          image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
-          command: ["cp", "/usr/local/bin/kubectl", "/tools/kubectl"]
+        # tea login hermes-bot, written from the mounted token into an
+        # emptyDir at the agent's ~/.config/tea.
+        - name: tea-login
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - sh
+            - -ec
+            - |
+              umask 077
+              {
+                echo 'logins:'
+                echo '  - name: hermes-bot'
+                echo '    url: https://gitea.renner.uno'
+                echo "    token: $(cat /var/run/secrets/gitea/api-token)"
+                echo '    default: true'
+                echo '    user: hermes-bot'
+              } > /tea/config.yml
          securityContext:
            runAsUser: 10000
            runAsGroup: 10000
@@ -109,11 +120,14 @@ spec:
            capabilities:
              drop: ["ALL"]
          volumeMounts:
-            - name: tools
-              mountPath: /tools
+            - name: tea-config
+              mountPath: /tea
+            - name: gitea-token
+              mountPath: /var/run/secrets/gitea
+              readOnly: true
      containers:
        - name: hermes
-          image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
          args: ["gateway", "run"]
          env:
            - name: HERMES_DASHBOARD
@@ -130,6 +144,29 @@ spec:
              value: "true"
            - name: API_SERVER_HOST
              value: 0.0.0.0
+            # bao: log in with the pod's ServiceAccount token, role hermes
+            # (kubernetes/infrastructure/openbao/policies/hermes.hcl).
+            - name: BAO_ADDR
+              value: http://openbao.openbao.svc.cluster.local:8200
+            # talosctl: os:reader talosconfig from the talos.dev ServiceAccount
+            # hermes-talos (talos-serviceaccount.yaml).
+            - name: TALOSCONFIG
+              value: /var/run/secrets/talos.dev/config
+            # git as hermes-bot: the credential helper reads the mounted token.
+            - name: GIT_CONFIG_COUNT
+              value: "3"
+            - name: GIT_CONFIG_KEY_0
+              value: credential.https://gitea.renner.uno.helper
+            - name: GIT_CONFIG_VALUE_0
+              value: '!f() { test "$1" = get && echo username=hermes-bot && echo "password=$(cat /var/run/secrets/gitea/api-token)"; }; f'
+            - name: GIT_CONFIG_KEY_1
+              value: user.name
+            - name: GIT_CONFIG_VALUE_1
+              value: hermes-bot
+            - name: GIT_CONFIG_KEY_2
+              value: user.email
+            - name: GIT_CONFIG_VALUE_2
+              value: hermes-bot@konstantin-renner.de
          envFrom:
            - secretRef:
                name: hermes-api-key
@@ -166,8 +203,6 @@ spec:
          volumeMounts:
            - name: data
              mountPath: /opt/data
-            - name: tools
-              mountPath: /opt/data/.local/bin
            # Identity and house rules from git (SOUL.md beside this file).
            - name: soul
              mountPath: /opt/data/SOUL.md
@@ -179,12 +214,18 @@ spec:
            - name: wiki-key
              mountPath: /var/run/secrets/wiki
              readOnly: true
+            - name: gitea-token
+              mountPath: /var/run/secrets/gitea
+              readOnly: true
+            - name: tea-config
+              mountPath: /opt/data/home/.config/tea
+            - name: talos-config
+              mountPath: /var/run/secrets/talos.dev
+              readOnly: true
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: hermes-data
-        - name: tools
-          emptyDir: {}
        - name: soul
          configMap:
            name: hermes-soul
@@ -200,6 +241,15 @@ spec:
          secret:
            secretName: hermes-wiki
            optional: true
+        - name: gitea-token
+          secret:
+            secretName: hermes-gitea
+        - name: tea-config
+          emptyDir: {}
+        - name: talos-config
+          secret:
+            secretName: hermes-talos
+            optional: true
 ---
 apiVersion: v1
 kind: Service
@@ -4,6 +4,8 @@ resources:
  - rbac.yaml
  - api-key.yaml
  - wiki-externalsecret.yaml
+  - gitea-externalsecret.yaml
+  - talos-serviceaccount.yaml
  - hermes.yaml
  - ingress.yaml
 configMapGenerator:
@@ -0,0 +1,12 @@
+# Talos issues an os:reader talosconfig into Secret hermes-talos (key
+# `config`, endpoint talos.default:50000). Needs
+# machine.features.kubernetesTalosAPIAccess on the control planes
+# (kubernetes/talos/patches/cluster.yaml).
+apiVersion: talos.dev/v1alpha1
+kind: ServiceAccount
+metadata:
+  name: hermes-talos
+  namespace: hermes
+spec:
+  roles:
+    - os:reader
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0615 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0646 # {"$imagepolicy": "flux-system:kuma-sync"}
          env:
            - name: KUMA_URL
              value: https://kuma.renner.uno
@@ -5,3 +5,4 @@ resources:
  - externalsecret.yaml
  - rbac.yaml
  - deployment.yaml
+  - monitors
@@ -0,0 +1,53 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Audiobooks
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks-health
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Audiobookshelf Health
+  parentRef:
+    name: audiobooks
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://audiobooks.renner.uno/healthcheck
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: OK
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: audiobooks-status
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Audiobookshelf Server
+  parentRef:
+    name: audiobooks
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # initialized-server flag from the unauthenticated status endpoint
+    url: https://audiobooks.renner.uno/status
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: isInit
+    operator: ==
+    expected: "true"
@@ -0,0 +1,48 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Authentik
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth-live
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Authentik Live
+  parentRef:
+    name: auth
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # ungated health endpoint, empty body
+    url: https://auth.renner.uno/-/health/live/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: auth-ready
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Authentik Ready
+  parentRef:
+    name: auth
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # ungated readiness endpoint (database and cache), empty body
+    url: https://auth.renner.uno/-/health/ready/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
@@ -0,0 +1,30 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: docs
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Documents
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: docs-gate
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Documents Login
+  parentRef:
+    name: docs
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 20
+  http:
+    # Paperless is fully behind the Authentik gate; asserts the login page the redirect chain ends on
+    url: https://docs.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: <title>authentik</title>
@@ -0,0 +1,53 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Home Assistant
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home-api
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Home Assistant API
+  parentRef:
+    name: home
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # unauthenticated login-provider list, served by the HA core backend
+    url: https://home.renner.uno/auth/providers
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: providers[type="homeassistant"].name
+    operator: ==
+    expected: Home Assistant Local
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: home-web
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: Home Assistant Web
+  parentRef:
+    name: home
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://home.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: <title>Home Assistant</title>
@@ -0,0 +1,31 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: immich
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Immich
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: immich-api
+  namespace: kuma-sync
+spec:
+  type: json-query
+  displayName: Immich API
+  parentRef:
+    name: immich
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://immich.renner.uno/api/server/ping
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  jsonQuery:
+    expression: res
+    operator: ==
+    expected: pong
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - renner-uno.yaml
+  - home.yaml
+  - immich.yaml
+  - auth.yaml
+  - docs.yaml
+  - audiobooks.yaml
+  - third-party.yaml
@@ -0,0 +1,51 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Renner.uno Website
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno-www
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: www.renner.uno
+  parentRef:
+    name: renner-uno
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    url: https://www.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: Familie Renner
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: renner-uno-apex
+  namespace: kuma-sync
+spec:
+  type: keyword
+  displayName: renner.uno
+  parentRef:
+    name: renner-uno
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 10
+  http:
+    # 301 to www, followed
+    url: https://renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: Familie Renner
@@ -0,0 +1,87 @@
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: third-party
+  namespace: kuma-sync
+spec:
+  type: group
+  displayName: Third-party
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-portal
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Portal
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    # root 302s to / to set a session cookie; Kuma keeps no cookies, so do not follow
+    url: https://portal.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299", "302"]
+    maxRedirects: 0
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-tech
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Technician Portal
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    url: https://tech.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: mcb-www
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: MCB Website
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    # 301 to /index.html, followed
+    url: https://www.multi-circuit-boards.eu/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: turm1388
+  namespace: kuma-sync
+spec:
+  type: http
+  displayName: Wohnen im Turm
+  parentRef:
+    name: third-party
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 15
+  http:
+    url: https://turm1388.de/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
@@ -4,13 +4,10 @@ metadata:
  name: hermes
  namespace: flux-system
 spec:
-  image: nousresearch/hermes-agent
-  interval: 1h
+  image: gitea.renner.uno/konairius/hermes
+  interval: 10m
 ---
-# v-prefix tags (v0.22.2). The filter skips rc.*, -desktop and per-arch tags.
-# The repo also carries the retired date-versioned releases (v2026.4.3 ..
-# v2026.9.24, last one 2026-09-24); as semver they sort above 0.x, so the
-# range caps below 1.0.0 or the policy picks the old v2026.9.24.
+# .woodpecker/hermes-image.yml tags every build `build.<unix-ts>`; latest push wins.
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
@@ -20,8 +17,8 @@ spec:
  imageRepositoryRef:
    name: hermes
  filterTags:
-    pattern: '^v(?P<ver>\d+\.\d+\.\d+)$'
-    extract: '$ver'
+    pattern: '^build\.(?P<ts>\d+)$'
+    extract: '$ts'
  policy:
-    semver:
-      range: ">=0.22.2 <1.0.0"
+    numerical:
+      order: asc
@@ -122,6 +122,24 @@ spec:
        - ports:
            - port: "8080"
              protocol: TCP
+    # OpenBao Kubernetes-auth login and apps/hermes reads; ingress side is
+    # openbao-ns.yaml.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": openbao
+            app.kubernetes.io/name: openbao
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP
+    # Talos apid (talosctl via Service default/talos, endpoints are the node IPs).
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "50000"
+              protocol: TCP
 ---
 # Traefik serves the dashboard (9119) and the OpenAI-compatible API (8642).
 apiVersion: cilium.io/v2
@@ -41,6 +41,15 @@ spec:
        - ports:
            - port: "8200"
              protocol: TCP
+    # Hermes Agent logs in via auth/kubernetes/role/hermes and reads apps/hermes.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+            app.kubernetes.io/name: hermes
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP
    # (Secret-rotation CronJobs run in THIS namespace since 2026-07-18, so their
    # OpenBao access is covered by the intra-namespace ingress rule above — no
    # per-app rule needed.)
@@ -0,0 +1,26 @@
+# OpenBao policy: hermes
+#
+# Hermes Agent (Deployment hermes, namespace hermes) logs in with its pod
+# ServiceAccount token and reads its own app secrets.
+#
+# NOT applied by Flux. Apply ONCE with an admin token:
+#
+#   bao policy write hermes kubernetes/infrastructure/openbao/policies/hermes.hcl
+#   bao write auth/kubernetes/role/hermes \
+#     bound_service_account_names=hermes \
+#     bound_service_account_namespaces=hermes \
+#     policies=hermes ttl=1h
+#
+# Do NOT set token_no_default_policy=true (kv-v2 preflight needs the default policy).
+
+path "homelab/data/apps/hermes/*" {
+  capabilities = ["read"]
+}
+
+path "homelab/metadata/apps/hermes/*" {
+  capabilities = ["read", "list"]
+}
+
+path "homelab/metadata/apps/hermes" {
+  capabilities = ["list"]
+}
@@ -38,6 +38,14 @@ machine:
    hostDNS:
      enabled: true
      forwardKubeDNSToHost: true
+    # talos.dev ServiceAccounts: os:reader talosconfigs for Hermes Agent
+    # (apps/hermes/talos-serviceaccount.yaml). Control planes only.
+    kubernetesTalosAPIAccess:
+      enabled: true
+      allowedRoles:
+        - os:reader
+      allowedKubernetesNamespaces:
+        - hermes
  nodeLabels:
    node.kubernetes.io/exclude-from-external-load-balancers: ""
  kubelet:
@@ -45,6 +45,7 @@
        "ghcr.io/usetrmnl/terminus",
        "ghcr.io/usetrmnl/trmnl-ha-amd64",
        "gitea.renner.uno/k.renner/shelly-manager",
+        "gitea.renner.uno/konairius/hermes",
        "gitea.renner.uno/konairius/vsftpd",
        "gitea.renner.uno/konairius/wiki",
        "gotenberg/gotenberg",
@@ -215,6 +216,24 @@
        "lscr.io/linuxserver/beets"
      ],
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
+    },
+    {
+      "description": "Hermes image (ci/images/hermes): its merge rolls out to the cluster via Flux image automation, so it is not CI-only. One PR of its own.",
+      "matchFileNames": [
+        "ci/images/hermes/**"
+      ],
+      "groupName": "hermes image",
+      "groupSlug": "hermes-image"
+    },
+    {
+      "description": "nousresearch/hermes-agent also carries the retired date-versioned tags (v2026.x), which sort above v0.x.",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "nousresearch/hermes-agent"
+      ],
+      "allowedVersions": "/^v0\\./"
    }
  ]
 }
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	dcf9e24dec	feat(hermes): log talosctl, bao and tea in ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details talosctl: os:reader through Talos's Kubernetes API access. cluster.yaml enables machine.features.kubernetesTalosAPIAccess for namespace hermes, role os:reader; already applied to k8s-1, k8s-2, k8s-3 with `talosctl patch machineconfig --mode=no-reboot`, one node at a time with `talosctl health` between. The talos.dev ServiceAccount hermes-talos gets Secret hermes-talos (key config), mounted at /var/run/secrets/talos.dev with TALOSCONFIG pointing at it. Egress to host/remote-node :50000 (Service default/talos endpoints are the node InternalIPs). bao: policy hermes (read on homelab/apps/hermes/*) and Kubernetes-auth role hermes for SA hermes/hermes, applied by hand like netbird-service-sync (commands in hermes.hcl). BAO_ADDR is the in-cluster service; CNPs both ways on :8200. tea: an init container writes config.yml for login hermes-bot from the mounted Gitea token into an emptyDir at the agent's ~/.config/tea (subprocess HOME is /opt/data/home), so no token lands on the PVC. SOUL.md says how to use all three. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 10:54:42 +02:00
k.renner	df0b344f7f	Merge pull request 'fix(hermes): push the Hermes image as registry-bot' (#1369 ) from fix/hermes-image-registry-bot into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline failed Details Reviewed-on: k.renner/homelab#1369	2026-10-19 08:31:56 +00:00
hermes-bot	46b7d458b3	fix(hermes): push the Hermes image as registry-bot review-bot reviewed: request changes Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details registry-bot is the konairius registry identity: write:package PAT, konairius org secret registry_bot_token, rotated by openbao/rotation/registry-bot.yaml. That rotation syncs the secret for the push, tag, release and manual events, so the manual trigger is `event: manual` instead of a deployment target. registry_bot_token is a konairius org secret. Woodpecker resolves org secrets through the repo's org link, so this pipeline gets it only once homelab has moved to konairius/homelab (docs/superpowers/plans/2026-10-18-homelab-konairius-main.md, cut-over 1).	2026-10-19 08:29:53 +00:00
security-bot	2d04575c51	chore(image-automation): bump gitea.renner.uno/konairius/hermes:build.1792397861 ci/woodpecker/cron/alert-monitor Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-19 08:20:50 +00:00
k.renner	97310db78c	Merge pull request 'feat(hermes): run the in-house Hermes image' (#1367 ) from feat/hermes-use-custom-image into master ci/woodpecker/push/build-ci-images Pipeline was successful Details ci/woodpecker/push/hermes-image Pipeline was successful Details Reviewed-on: k.renner/homelab#1367	2026-10-19 08:16:53 +00:00
k.renner	085f969f63	Merge pull request 'feat(hermes): build a Hermes image with the agent's CLI tools' (#1366 ) from feat/hermes-image into master ci/woodpecker/push/build-ci-images Pipeline is pending Details ci/woodpecker/push/hermes-image Pipeline is pending Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#1366 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-19 08:12:26 +00:00
hermes-bot	d00ee70b23	fix(hermes): run the Hermes image from the konairius org review-bot reviewed: request changes Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details	2026-10-19 08:10:18 +00:00
hermes-bot	8ea8318c6e	Merge branch 'feat/hermes-image' into feat/hermes-use-custom-image	2026-10-19 08:10:13 +00:00
hermes-bot	fbc1aaef21	fix(hermes): publish the Hermes image under the konairius org ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details review-bot reviewed: approve Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-10-19 08:10:11 +00:00
hermes-bot	be9898f7b0	chore(renovate): leave gitea_admin/hermes to Flux image automation review-bot reviewed: request changes Details ci/woodpecker/pr/ci-scripts-test Pipeline was canceled Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details	2026-10-19 08:06:10 +00:00
hermes-bot	3c5c04d4a5	fix(hermes): let Renovate keep the Hermes image current ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details review-bot reviewed: comment Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details Drops the daily cron and the upstream-polling decide step. Every version in ci/images/hermes/Containerfile is now an image reference (FROM for nousresearch/hermes-agent, COPY --from for talosctl, kubectl, flux, bao and tea), which Renovate's enabled dockerfile manager updates and digest-pins. A merged Renovate PR pushes to ci/images/hermes/**, the pipeline builds build.<unix-ts>, and Flux image automation rolls it out. No checksums to maintain: the binaries come from digest-pinned images. renovate.json: the hermes Containerfile gets a PR of its own instead of the "CI non-major" group (that group is for changes that never reach the cluster), and nousresearch/hermes-agent is held to v0.x because the retired date-versioned v2026.x tags sort above it. Verified: each COPY --from path exists in the pinned image and the binary runs on the hermes-agent v0.22.2 base. renovate-config-validator 37.440.7 reports only the two pre-existing errors on master (flux/kubernetes.managerFilePatterns).	2026-10-19 08:06:09 +00:00
hermes-bot	3ed7741c68	docs(hermes): tea is in the image now, still not logged in review-bot reviewed: request changes Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details	2026-10-19 07:58:27 +00:00
hermes-bot	f73cc54705	feat(hermes): build a Hermes image with the agent's CLI tools review-bot reviewed: comment Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details nousresearch/hermes-agent ships no talosctl, kubectl, flux, bao, tea or jq. The kubectl init container dropped its binary in /opt/data/.local/bin, which the agent's terminal never has on PATH: Hermes snapshots the env from a bash login shell, and Debian's /etc/profile resets PATH for non-root users. /usr/local/bin survives that reset. Upstream's documented route for always-present tools is a derived image (docs/user-guide/docker, "Adding tools"). ci/images/hermes builds FROM the upstream release and adds the binaries, versions matched to the cluster (Talos v1.13.10, Kubernetes v1.36.3, Flux v2.9.5, OpenBao 2.7.1) and checksummed against upstream release checksums. .woodpecker/hermes-image.yml rebuilds daily when upstream publishes a new release (compared against the uno.renner.hermes.version label on :latest), and on any push to the Containerfile. Tags are build.<unix-ts>, the scheme Flux image automation already tracks for wiki and shelly-manager. Owner step after merge: register the cron woodpecker repo cron add --repo k.renner/homelab \ --name hermes-image --branch master --schedule '@daily' The Deployment switch follows in a separate PR once the first build exists, so the Recreate rollout never points at a missing tag.	2026-10-19 07:58:27 +00:00
hermes-bot	c8849b8d9c	feat(hermes): run the in-house Hermes image Switches apps/hermes to gitea.renner.uno/gitea_admin/hermes, which carries talosctl, kubectl, flux, bao, tea and jq in /usr/local/bin. The image-automation policy now tracks its build.<unix-ts> tags instead of upstream nousresearch/hermes-agent; .woodpecker/hermes-image.yml follows upstream releases. Drops the kubectl init container and its emptyDir: the binary sat in /opt/data/.local/bin, which the agent's terminal does not have on PATH.	2026-10-19 07:58:27 +00:00
k.renner	9d0707c1aa	Merge pull request 'feat(kuma-sync): Uptime Kuma monitors replacing UptimeRobot' (#1365 ) from feat/kuma-task5-monitors into master ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#1365	2026-10-19 07:57:25 +00:00
claude-botandClaude Opus 5.5	74db40710e	feat(kuma-sync): define Uptime Kuma monitors replacing UptimeRobot ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details review-bot reviewed: comment Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details One group per own service with application-level checks (json-query on health/API endpoints where ungated, keyword otherwise) and a Third-party group with plain checks. Endpoints verified from the Kuma VPS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 09:54:08 +02:00
k.renner	368dc24add	Merge pull request 'feat(hermes): push and open PRs on Gitea as hermes-bot' (#1364 ) from feat/hermes-gitea into master Reviewed-on: k.renner/homelab#1364	2026-10-19 07:49:07 +00:00
claude-botandClaude Opus 5.5	dfb2f71c85	feat(hermes): push and open PRs on Gitea as hermes-bot ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details review-bot skipped: closed Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details The owner placed hermes-bot's API token at OpenBao apps/hermes/gitea (api-token). ExternalSecret hermes-gitea mounts it as a file at /var/run/secrets/gitea/api-token. git is configured through GIT_CONFIG_* env on the container, so nothing lives on the PVC: a credential helper for https://gitea.renner.uno that answers with hermes-bot and the token read from the file, plus the commit identity hermes-bot <hermes-bot@konstantin-renner.de>. Hermes' subprocess env scrub only strips its own provider/messaging secrets, so GIT_* reaches the terminal tool. SOUL.md drops "no write access" and tells the agent how to use git and the REST API (no tea in the image) without printing the token; the existing feature-branch/PR/no-self-merge rules apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 09:48:05 +02:00
k.renner	6b78f4cb5b	Merge pull request 'fix(hermes): put the generated ConfigMaps in the hermes namespace' (#1361 ) from fix/hermes-configmap-namespace into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#1361	2026-10-19 07:06:08 +00:00
security-bot	2b1016bd4a	chore(image-automation): bump gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0646 nousresearch/hermes-agent:v0.22.2 ci/woodpecker/cron/alert-monitor Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-19 06:56:39 +00:00