feat(hermes): chat with Hermes over Matrix

In the dashboard an agent lives only as long as its browser PTY connection (close_on_disconnect sessions are reaped on disconnect, upstream #136713). The messaging gateway that already runs in the pod (`gateway run`) keeps conversations server-side instead, so Hermes joins our Matrix homeserver as a bot: - account @hermes:matrix.renner.uno, registered in MAS without a password (token-only), compatibility token on fixed device HERMESBOT in OpenBao apps/hermes/matrix -> ExternalSecret hermes-matrix (MATRIX_ACCESS_TOKEN). A stable device keeps the E2EE store under /opt/data valid. - MATRIX_HOMESERVER https://matrix.renner.uno (via Traefik, already in the hermes egress), MATRIX_ALLOWED_USERS @k.renner only, MATRIX_E2EE_MODE=required (mautrix[encryption] and libolm are in the image). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore(image-automation): bump ghcr.io/paperless-ngx/paperless-ngx:3.3.3
2026-10-20 08:18:42 +02:00 · 2026-10-19 17:43:24 +00:00 · 2026-10-19 14:20:55 +00:00 · 2026-10-19 14:14:03 +00:00
5 changed files with 33 additions and 2 deletions
@@ -171,6 +171,16 @@ spec:
              value: "true"
            - name: API_SERVER_HOST
              value: 0.0.0.0
+            # Matrix: bot @hermes (MAS account, compatibility token on device
+            # HERMESBOT in hermes-matrix); E2EE store under /opt/data/platforms/matrix.
+            - name: MATRIX_HOMESERVER
+              value: https://matrix.renner.uno
+            - name: MATRIX_USER_ID
+              value: "@hermes:matrix.renner.uno"
+            - name: MATRIX_ALLOWED_USERS
+              value: "@k.renner:matrix.renner.uno"
+            - name: MATRIX_E2EE_MODE
+              value: required
            # bao: log in with the pod's ServiceAccount token, role hermes
            # (kubernetes/infrastructure/openbao/policies/hermes.hcl).
            - name: BAO_ADDR
@@ -197,6 +207,8 @@ spec:
          envFrom:
            - secretRef:
                name: hermes-api-key
+            - secretRef:
+                name: hermes-matrix
          ports:
            - name: dashboard
              containerPort: 9119
@@ -5,6 +5,7 @@ resources:
  - api-key.yaml
  - wiki-externalsecret.yaml
  - gitea-externalsecret.yaml
+  - matrix-externalsecret.yaml
  - talos-serviceaccount.yaml
  - hermes.yaml
  - ingress.yaml
@@ -0,0 +1,18 @@
+# Access token of @hermes:matrix.renner.uno (MAS compatibility token, device HERMESBOT).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hermes-matrix
+  namespace: hermes
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hermes-matrix
+  data:
+    - secretKey: MATRIX_ACCESS_TOKEN
+      remoteRef:
+        key: apps/hermes/matrix
+        property: access_token
@@ -182,7 +182,7 @@ spec:
              drop: ["ALL"]
      containers:
        - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.3.2 # {"$imagepolicy": "flux-system:paperless-ngx"}
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.3.3 # {"$imagepolicy": "flux-system:paperless-ngx"}
          ports:
            - name: http
              containerPort: 8000
@@ -53,7 +53,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1792404861 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1792419299 # {"$imagepolicy": "flux-system:wiki"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	79be70b84e	feat(hermes): chat with Hermes over Matrix ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details In the dashboard an agent lives only as long as its browser PTY connection (close_on_disconnect sessions are reaped on disconnect, upstream #136713). The messaging gateway that already runs in the pod (`gateway run`) keeps conversations server-side instead, so Hermes joins our Matrix homeserver as a bot: - account @hermes:matrix.renner.uno, registered in MAS without a password (token-only), compatibility token on fixed device HERMESBOT in OpenBao apps/hermes/matrix -> ExternalSecret hermes-matrix (MATRIX_ACCESS_TOKEN). A stable device keeps the E2EE store under /opt/data valid. - MATRIX_HOMESERVER https://matrix.renner.uno (via Traefik, already in the hermes egress), MATRIX_ALLOWED_USERS @k.renner only, MATRIX_E2EE_MODE=required (mautrix[encryption] and libolm are in the image). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 08:18:42 +02:00
security-bot	dd21d961f3	chore(image-automation): bump ghcr.io/paperless-ngx/paperless-ngx:3.3.3 ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-19 17:43:24 +00:00
security-bot	8d36bbebea	chore(image-automation): bump gitea.renner.uno/konairius/wiki:build.1792419299 ci/woodpecker/cron/alert-monitor Pipeline was successful Details ci/woodpecker/cron/issue-fix Pipeline was successful Details Updates managed by image-automation-controller.	2026-10-19 14:20:55 +00:00
k.renner	b0e3999ef2	Merge pull request 'fix(wiki): the service reads the wiki-index BasicAuth users' (#1388 ) from fix/wiki-basic-auth-in-service into main ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: #1388	2026-10-19 14:14:03 +00:00