titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

refactor(hermes): rename chat and triage public hostnames #34

Merged
bstein merged 1 commits from feature/hermes-domain-rename-chat-bstein-triage into main 2026-08-21 07:48:56 +00:00
Conversation 1 Commits 1 Files Changed 24 +51 -51
hermes-automation commented 2026-08-21 07:00:35 +00:00
Member
Copy Link

Supersedes obsolete draft #28

This draft replaces #28, whose chat target is obsolete. Brad should close #28 unmerged. This branch does not modify, rebase, merge, or reuse that branch.

Corrected public hostnames:

  • chat.hermes.bstein.dev -> chat.bstein.dev
  • triage.hermes.bstein.dev -> triage.bstein.dev

agent.hermes.bstein.dev is deliberately unchanged. The rendered Hermes manifest contains it 16 times both before and after this change.

Collision and scope review

Before editing, git grep found chat.bstein.dev only in mermaid/ServiceAccessArchitecture.mmd and its generated SVG. The source diagram already connects that planned personal domain to Hermes Chat, so it is intentional architecture documentation rather than a competing functional owner. No corrected target was present in CoreDNS, ingress/TLS, OAuth, Keycloak ensure, application origin configuration, or the generated HTTP catalog before this change; both names also returned no address through the current resolver.

The rename covers:

  • CoreDNS plus the shared certificate SANs and ingress TLS/rules.
  • oauth2-proxy callback URLs.
  • Keycloak redirect URI, web origin, root URL, and post-logout origin through hermes_access_oidc_ensure.sh.
  • dashboard public URLs, API CORS origins, WebUI allowed origins, and Ariadne proposal links.
  • Telegram/UI links, outbound public-fetch User-Agent, quality scan targets, operator notes, mounted agent instructions, and the Hermes architecture skill.
  • canonical knowledge catalogs and HTTP diagrams plus their comms mirrors.

The knowledge renderer was run for both current origin/main and the changed tree. Those renders differ only in the two catalog host values and corresponding Mermaid node IDs; summary, metrics, and runbook artifacts are byte-identical. Current main has unrelated generated backlog, so this PR carries only that renderer-derived hostname delta.

One old-host string remains intentionally in testing/tests/data/hermes_kanban_card_corpus.jsonl: it is a frozen historical task record used as test data, not functional configuration or current documentation.

Rollout dependencies

This rename is not self-contained and ordering matters:

  1. New DNS and certificates must work before the old hosts retire. After Flux reconciliation, wait for CoreDNS to serve both corrected names and for hermes-sites-tls to be Ready with chat.bstein.dev, triage.bstein.dev, and the preserved agent.hermes.bstein.dev SAN before announcing or retiring anything.
  2. Re-run the Keycloak ensure job/script so the chat and triage proxy clients receive the corrected redirect URI, web origin, root URL, and post-logout origin. Login will fail until that ensure step has completed.
  3. Users must log in again. oauth2-proxy uses host-bound cookies, so sessions from the old origins do not carry to the corrected origins.
  4. Old-host redirects are proposed only and are not silently added here. A redirect follow-up would need an explicit retention window for old DNS, ingress rules, and certificate SANs. This PR intentionally contains no redirect middleware or retained old-host routing.

Validation

  • Fresh base: current origin/main db70509e08699e823e677a5567f2c7fdb4f4ea9b; branch is one commit ahead and zero behind.
  • kustomize build passes after rebase for infrastructure/core, services/comms, services/hermes, services/keycloak, services/maintenance, services/maintenance/apps, and services/quality.
  • git grep --no-index over all seven rendered outputs finds neither obsolete functional hostname.
  • make test after rebase: 2620 passed, 4 failed, 4 skipped. The four failures are reproduced exactly on origin/main: two agent resource expectation tests, the Gitea HTTP-error isolation test, and the Kanban auto-supervise default test.
  • Router GO111MODULE=off CGO_ENABLED=0 go test: pass.
  • Keycloak sh -n: pass.
  • git diff --check: pass.
  • The broker accepted a scanner-validated explicit non-thin pack and the remote branch head matches this commit exactly.

Draft only. Do not merge until the rollout dependencies above are scheduled and #28 is closed unmerged.

## Supersedes obsolete draft #28 This draft replaces #28, whose chat target is obsolete. Brad should close #28 unmerged. This branch does not modify, rebase, merge, or reuse that branch. Corrected public hostnames: - `chat.hermes.bstein.dev` -> `chat.bstein.dev` - `triage.hermes.bstein.dev` -> `triage.bstein.dev` `agent.hermes.bstein.dev` is deliberately unchanged. The rendered Hermes manifest contains it 16 times both before and after this change. ## Collision and scope review Before editing, `git grep` found `chat.bstein.dev` only in `mermaid/ServiceAccessArchitecture.mmd` and its generated SVG. The source diagram already connects that planned personal domain to Hermes Chat, so it is intentional architecture documentation rather than a competing functional owner. No corrected target was present in CoreDNS, ingress/TLS, OAuth, Keycloak ensure, application origin configuration, or the generated HTTP catalog before this change; both names also returned no address through the current resolver. The rename covers: - CoreDNS plus the shared certificate SANs and ingress TLS/rules. - oauth2-proxy callback URLs. - Keycloak redirect URI, web origin, root URL, and post-logout origin through `hermes_access_oidc_ensure.sh`. - dashboard public URLs, API CORS origins, WebUI allowed origins, and Ariadne proposal links. - Telegram/UI links, outbound public-fetch User-Agent, quality scan targets, operator notes, mounted agent instructions, and the Hermes architecture skill. - canonical knowledge catalogs and HTTP diagrams plus their comms mirrors. The knowledge renderer was run for both current `origin/main` and the changed tree. Those renders differ only in the two catalog host values and corresponding Mermaid node IDs; summary, metrics, and runbook artifacts are byte-identical. Current main has unrelated generated backlog, so this PR carries only that renderer-derived hostname delta. One old-host string remains intentionally in `testing/tests/data/hermes_kanban_card_corpus.jsonl`: it is a frozen historical task record used as test data, not functional configuration or current documentation. ## Rollout dependencies This rename is not self-contained and ordering matters: 1. New DNS and certificates must work before the old hosts retire. After Flux reconciliation, wait for CoreDNS to serve both corrected names and for `hermes-sites-tls` to be Ready with `chat.bstein.dev`, `triage.bstein.dev`, and the preserved `agent.hermes.bstein.dev` SAN before announcing or retiring anything. 2. Re-run the Keycloak ensure job/script so the chat and triage proxy clients receive the corrected redirect URI, web origin, root URL, and post-logout origin. Login will fail until that ensure step has completed. 3. Users must log in again. oauth2-proxy uses host-bound cookies, so sessions from the old origins do not carry to the corrected origins. 4. Old-host redirects are proposed only and are not silently added here. A redirect follow-up would need an explicit retention window for old DNS, ingress rules, and certificate SANs. This PR intentionally contains no redirect middleware or retained old-host routing. ## Validation - Fresh base: current `origin/main` `db70509e08699e823e677a5567f2c7fdb4f4ea9b`; branch is one commit ahead and zero behind. - `kustomize build` passes after rebase for `infrastructure/core`, `services/comms`, `services/hermes`, `services/keycloak`, `services/maintenance`, `services/maintenance/apps`, and `services/quality`. - `git grep --no-index` over all seven rendered outputs finds neither obsolete functional hostname. - `make test` after rebase: 2620 passed, 4 failed, 4 skipped. The four failures are reproduced exactly on `origin/main`: two agent resource expectation tests, the Gitea HTTP-error isolation test, and the Kanban auto-supervise default test. - Router `GO111MODULE=off CGO_ENABLED=0 go test`: pass. - Keycloak `sh -n`: pass. - `git diff --check`: pass. - The broker accepted a scanner-validated explicit non-thin pack and the remote branch head matches this commit exactly. Draft only. Do not merge until the rollout dependencies above are scheduled and #28 is closed unmerged.
hermes-automation added 1 commit 2026-08-21 07:00:36 +00:00
bstein approved these changes 2026-08-21 07:40:54 +00:00
bstein changed title from WIP: refactor(hermes): rename chat and triage public hostnames to refactor(hermes): rename chat and triage public hostnames 2026-08-21 07:40:58 +00:00
bstein merged commit 8ace4d47e1 into main 2026-08-21 07:48:56 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
bstein
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
atlas-reconciler bstein hermes-automation
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: titan/atlas-iac#34
No description provided.
Delete Branch "feature/hermes-domain-rename-chat-bstein-triage"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?