claude-bot
dd954ce23a
Hermes Agent as a pod in its own `hermes` namespace: gateway (messaging platforms, cron, OpenAI-compatible API) and dashboard, supervised by the image's s6-overlay, state on a 10Gi ceph-block PVC. - hermes.renner.uno (LAN): dashboard and Hermes Desktop remote gateway. Plain Traefik plus the dashboard's own Authentik OIDC login (public PKCE client, Hermes Users group) — a forward-auth gate would break Desktop's Bearer-token calls. - hermes-api.renner.uno (LAN): API server, Bearer key generated in-cluster by an ESO Password generator. - Read-only kubectl via the built-in `view` ClusterRole. - CNPs: world 443/80, kube-apiserver, Traefik for LAN hostnames, and Prometheus/Alertmanager/Loki (with the matching monitoring-side grant). - Image automation for nousresearch/hermes-agent v-tags. After deploy: log in to Anthropic inside the pod (`hermes auth add anthropic --type oauth --no-browser`, then `hermes model`); platform and Home Assistant tokens go in via the dashboard. Not yet covered: a Velero schedule for the PVC.