claude-bot
dd954ce23a
Hermes Agent as a pod in its own `hermes` namespace: gateway (messaging platforms, cron, OpenAI-compatible API) and dashboard, supervised by the image's s6-overlay, state on a 10Gi ceph-block PVC. - hermes.renner.uno (LAN): dashboard and Hermes Desktop remote gateway. Plain Traefik plus the dashboard's own Authentik OIDC login (public PKCE client, Hermes Users group) — a forward-auth gate would break Desktop's Bearer-token calls. - hermes-api.renner.uno (LAN): API server, Bearer key generated in-cluster by an ESO Password generator. - Read-only kubectl via the built-in `view` ClusterRole. - CNPs: world 443/80, kube-apiserver, Traefik for LAN hostnames, and Prometheus/Alertmanager/Loki (with the matching monitoring-side grant). - Image automation for nousresearch/hermes-agent v-tags. After deploy: log in to Anthropic inside the pod (`hermes auth add anthropic --type oauth --no-browser`, then `hermes model`); platform and Home Assistant tokens go in via the dashboard. Not yet covered: a Velero schedule for the PVC.
33 lines
823 B
YAML
33 lines
823 B
YAML
# Bearer key for the OpenAI-compatible API server (hermes-api.renner.uno).
|
|
# Generated once in-cluster, nothing in OpenBao. Read it with
|
|
# kubectl -n hermes get secret hermes-api-key -o jsonpath='{.data.API_SERVER_KEY}' | base64 -d
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
metadata:
|
|
name: hermes-api-key
|
|
namespace: hermes
|
|
spec:
|
|
length: 64
|
|
digits: 16
|
|
symbols: 0
|
|
allowRepeat: true
|
|
noUpper: false
|
|
secretKeys:
|
|
- API_SERVER_KEY
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: hermes-api-key
|
|
namespace: hermes
|
|
spec:
|
|
refreshPolicy: CreatedOnce
|
|
target:
|
|
name: hermes-api-key
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
name: hermes-api-key
|