fix(hermes): keep image automation off the retired date-versioned tags

nousresearch/hermes-agent still carries v2026.4.3..v2026.9.24 from the
old date-based scheme. As semver they sort above 0.x, so '>=0.22.2'
picked v2026.9.24 (2026-09-24) and rolled the pod back from v0.22.2.
Cap the range below 1.0.0 and pin the manifests back to v0.22.2.

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -974,6 +974,71 @@ data:
           negate: false
           failure_result: false
 
+      # Hermes Agent dashboard (apps/hermes): its self-hosted OIDC login,
+      # also brokered for Hermes Desktop's native sign-in. Public client +
+      # PKCE (Hermes does not support confidential clients); RS256 so the
+      # dashboard can verify the ID token against the JWKS.
+      - id: hermes-users-group
+        model: authentik_core.group
+        identifiers:
+          name: Hermes Users
+        state: present
+        attrs:
+          is_superuser: false
+          # Members get the agent, which holds a read-only kubeconfig and
+          # the model login. Add/remove members HERE.
+          users:
+            - !Find [authentik_core.user, [username, k.renner]]
+
+      - id: hermes-provider
+        model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Hermes Dashboard
+        state: present
+        attrs:
+          authentication_flow: null
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: hermes-dashboard
+          # See the Matrix (MAS) provider: a blueprint-made provider starts
+          # with no grant types.
+          grant_types:
+            - authorization_code
+            - refresh_token
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+          redirect_uris:
+            - url: https://hermes.renner.uno/auth/callback
+              matching_mode: strict
+
+      # The slug is the issuer path: https://auth.renner.uno/application/o/hermes/
+      - model: authentik_core.application
+        identifiers:
+          slug: hermes
+        state: present
+        attrs:
+          name: Hermes
+          slug: hermes
+          provider: !KeyOf hermes-provider
+          meta_launch_url: https://hermes.renner.uno
+          meta_description: "Hermes Agent dashboard"
+
+      # Only the Hermes Users group passes.
+      - model: authentik_policies.policybinding
+        identifiers:
+          target: !Find [authentik_core.application, [slug, hermes]]
+          group: !KeyOf hermes-users-group
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: false
+
       # OpenProject, decommissioned. Application first: Application.provider
       # is on_delete=PROTECT. Its policy binding cascades with it.
       - model: authentik_core.application

kubernetes/apps/hermes/api-key.yaml

@@ -0,0 +1,32 @@
+# Bearer key for the OpenAI-compatible API server (hermes-api.renner.uno).
+# Generated once in-cluster, nothing in OpenBao. Read it with
+#   kubectl -n hermes get secret hermes-api-key -o jsonpath='{.data.API_SERVER_KEY}' | base64 -d
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - API_SERVER_KEY
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-api-key
+  namespace: hermes
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: hermes-api-key
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: hermes-api-key

kubernetes/apps/hermes/hermes.yaml

@@ -0,0 +1,170 @@
+# All Hermes state: config.yaml, .env (keys entered in the dashboard), auth.json
+# (the Anthropic OAuth login), sessions, memories, skills, cron. Mounted at
+# /opt/data, the image's HERMES_HOME.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hermes-data
+  namespace: hermes
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Hermes Agent: the gateway (messaging platforms, cron, API server on 8642) and
+# the dashboard (9119, also the Hermes Desktop remote-gateway backend), both
+# supervised by the image's s6-overlay. s6 must be PID 1 and starts as root,
+# remapping and dropping to the `hermes` user (10000).
+#
+# One replica, Recreate: two gateways must never share one data directory.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hermes
+    spec:
+      serviceAccountName: hermes
+      securityContext:
+        fsGroup: 10000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The dashboard trusts X-Forwarded-* only from listed peers; Traefik
+        # connects from the pod network. No env equivalent exists, so it is
+        # set in config.yaml on every start (idempotent).
+        - name: config
+          image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - /opt/hermes/.venv/bin/hermes
+            - config
+            - set
+            - dashboard.trusted_proxies
+            - '["10.244.0.0/16","fd10:244::/48"]'
+          env:
+            - name: HERMES_HOME
+              value: /opt/data
+            - name: HOME
+              value: /opt/data
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+        # kubectl for the agent. /opt/data/.local/bin is on the image's PATH;
+        # an emptyDir there keeps the binary out of the PVC and current with
+        # this pin.
+        - name: kubectl
+          image: docker.io/alpine/kubectl:1.37.1@sha256:b568e8beb6a79aee269c142343078a278b85e7710f1c0e7d8d6b21d1eb566a48
+          command: ["cp", "/usr/local/bin/kubectl", "/tools/kubectl"]
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tools
+              mountPath: /tools
+      containers:
+        - name: hermes
+          image: nousresearch/hermes-agent:v0.22.2 # {"$imagepolicy": "flux-system:hermes"}
+          args: ["gateway", "run"]
+          env:
+            - name: HERMES_DASHBOARD
+              value: "1"
+            - name: HERMES_DASHBOARD_PUBLIC_URL
+              value: https://hermes.renner.uno
+            # Dashboard login: Authentik OIDC, public PKCE client (blueprint
+            # in apps/authentik/blueprints-configmap.yaml, group Hermes Users).
+            - name: HERMES_DASHBOARD_OIDC_ISSUER
+              value: https://auth.renner.uno/application/o/hermes/
+            - name: HERMES_DASHBOARD_OIDC_CLIENT_ID
+              value: hermes-dashboard
+            - name: API_SERVER_ENABLED
+              value: "true"
+            - name: API_SERVER_HOST
+              value: 0.0.0.0
+          envFrom:
+            - secretRef:
+                name: hermes-api-key
+          ports:
+            - name: dashboard
+              containerPort: 9119
+            - name: api
+              containerPort: 8642
+          # The dashboard is the user-facing surface; /api/status is public.
+          startupProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 10
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: dashboard
+            periodSeconds: 60
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+            - name: tools
+              mountPath: /opt/data/.local/bin
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: hermes-data
+        - name: tools
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes
+  namespace: hermes
+  labels:
+    app.kubernetes.io/name: hermes
+spec:
+  selector:
+    app.kubernetes.io/name: hermes
+  ports:
+    - name: dashboard
+      port: 9119
+      targetPort: dashboard
+    - name: api
+      port: 8642
+      targetPort: api

kubernetes/apps/hermes/ingress.yaml

@@ -0,0 +1,59 @@
+# Both hosts are LAN-only (no dns.renner.uno/public or netbird.renner.uno/public
+# label).
+#
+# hermes.renner.uno — dashboard and Hermes Desktop remote gateway. Plain
+# Traefik, not the authentik-gate class: Hermes Desktop calls the API with a
+# Bearer token from its native (PKCE) sign-in, which a forward-auth gate would
+# redirect. Authentik still guards it: the dashboard's own OIDC login against
+# the `hermes` application, restricted to the Hermes Users group.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes.renner.uno
+      secretName: hermes-tls
+  rules:
+    - host: hermes.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 9119
+---
+# hermes-api.renner.uno — the OpenAI-compatible API server. Hermes checks
+# `Authorization: Bearer <API_SERVER_KEY>` itself (secret hermes-api-key).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes-api
+  namespace: hermes
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - hermes-api.renner.uno
+      secretName: hermes-api-tls
+  rules:
+    - host: hermes-api.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hermes
+                port:
+                  number: 8642

kubernetes/apps/hermes/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml
+  - api-key.yaml
+  - hermes.yaml
+  - ingress.yaml

kubernetes/apps/hermes/rbac.yaml

@@ -0,0 +1,22 @@
+# Read-only cluster access for the agent's kubectl, as for claude-workstation:
+# the built-in `view` ClusterRole, which excludes Secrets. The token is the
+# pod's projected ServiceAccount token; kubectl picks it up as in-cluster
+# config.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hermes
+  namespace: hermes
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: hermes-view
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: hermes
+    namespace: hermes

kubernetes/clusters/homelab/hermes.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/hermes
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds

kubernetes/infrastructure/image-automation/hermes.yaml

@@ -0,0 +1,27 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  image: nousresearch/hermes-agent
+  interval: 1h
+---
+# v-prefix tags (v0.22.2). The filter skips rc.*, -desktop and per-arch tags.
+# The repo also carries the retired date-versioned releases (v2026.4.3 ..
+# v2026.9.24, last one 2026-09-24); as semver they sort above 0.x, so the
+# range caps below 1.0.0 or the policy picks the old v2026.9.24.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: hermes
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: hermes
+  filterTags:
+    pattern: '^v(?P<ver>\d+\.\d+\.\d+)$'
+    extract: '$ver'
+  policy:
+    semver:
+      range: ">=0.22.2 <1.0.0"

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   - gatus.yaml
   - gitea-mcp.yaml
   - gotenberg.yaml
+  - hermes.yaml
   - home-assistant.yaml
   - immich.yaml
   - kuma-sync.yaml

kubernetes/infrastructure/namespaces/namespaces.yaml

@@ -294,3 +294,12 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: kuma-sync
+---
+# Hermes Agent (kubernetes/apps/hermes). Declared here so it exists before
+# infrastructure-crds applies its CNPs. No pod-security labels: the image's
+# s6-overlay init starts as root and drops to the `hermes` user, which the
+# cluster's default `baseline` enforcement allows.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hermes

kubernetes/infrastructure/network-policies/hermes-ns.yaml

@@ -0,0 +1,137 @@
+---
+# Baseline policy for the `hermes` namespace (Hermes Agent, apps/hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny
+  namespace: hermes
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Every LAN hostname (gitea, home, auth for the dashboard's OIDC
+    # discovery, matrix) via Traefik.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+---
+# The agent itself: model APIs (api.anthropic.com), web tools, messaging
+# platforms, read-only kubectl, and the monitoring read APIs. The matching
+# ingress grant on the monitoring side is monitoring-ns.yaml
+# (monitoring-allow-hermes).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-egress
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "80"
+              protocol: TCP
+    # `kube-apiserver` is its own entity in Cilium; port is the post-DNAT 6443.
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: prometheus
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: alertmanager
+      toPorts:
+        - ports:
+            - port: "9093"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+            app.kubernetes.io/name: loki
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+---
+# Traefik serves the dashboard (9119) and the OpenAI-compatible API (8642).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hermes-allow-traefik
+  namespace: hermes
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hermes
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "9119"
+              protocol: TCP
+            - port: "8642"
+              protocol: TCP

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -34,5 +34,6 @@ resources:
   - uptime-monitor-ns.yaml
   - kuma-sync-ns.yaml
   - renovate-ns.yaml
+  - hermes-ns.yaml
   - allow-cilium-health.yaml
   - kube-system-hubble-relay.yaml

kubernetes/infrastructure/network-policies/monitoring-ns.yaml

@@ -57,3 +57,30 @@ spec:
             - { type: 135, family: IPv6 }
             - { type: 136, family: IPv6 }
             - { type: 143, family: IPv6 }
+---
+# Hermes Agent (hermes ns) reads metrics, alerts and logs: the Prometheus,
+# Alertmanager and Loki HTTP APIs, scoped to those pods and ports.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: monitoring-allow-hermes
+  namespace: monitoring
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values: [prometheus, alertmanager, loki]
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": hermes
+            app.kubernetes.io/name: hermes
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+            - port: "9093"
+              protocol: TCP
+            - port: "3100"
+              protocol: TCP