diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml
index 64f809003..a79efd17e 100644
--- a/services/hermes/kustomization.yaml
+++ b/services/hermes/kustomization.yaml
@@ -29,6 +29,12 @@ resources:
- agent-ingress.yaml
configMapGenerator:
+ - name: hermes-chat-oauth-templates
+ namespace: hermes
+ files:
+ - error.html=oauth2-proxy-templates/error.html
+ options:
+ disableNameSuffixHash: true
- name: hermes-operator-guide
namespace: hermes
files:
diff --git a/services/hermes/oauth2-proxy-templates/error.html b/services/hermes/oauth2-proxy-templates/error.html
new file mode 100644
index 000000000..88398f11d
--- /dev/null
+++ b/services/hermes/oauth2-proxy-templates/error.html
@@ -0,0 +1,29 @@
+{{define "error.html"}}
+
+
+
+
+
+ {{.StatusCode}} {{.Title}}
+ {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}{{end}}
+
+
+
+
+ {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
+ Signing you back in…
+ The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.
+ Continue now
+ {{else}}
+ {{.StatusCode}} {{.Title}}
+ {{if .Message}}{{.Message}}
{{end}}
+ Sign in again
+ {{end}}
+
+
+
+{{end}}
diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml
index b6554e300..e6e4ef9be 100644
--- a/services/hermes/oauth2-proxy.yaml
+++ b/services/hermes/oauth2-proxy.yaml
@@ -9,43 +9,6 @@ data:
brad@bstein.dev
---
apiVersion: v1
-kind: ConfigMap
-metadata:
- name: hermes-chat-oauth-templates
- namespace: hermes
-data:
- error.html: |
- {{define "error.html"}}
-
-
-
-
-
- {{.StatusCode}} {{.Title}}
- {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}{{end}}
-
-
-
-
- {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
- Signing you back in…
- The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.
- Continue now
- {{else}}
- {{.StatusCode}} {{.Title}}
- {{if .Message}}{{.Message}}
{{end}}
- Sign in again
- {{end}}
-
-
-
- {{end}}
----
-apiVersion: v1
kind: Service
metadata:
name: oauth2-proxy-hermes-agent
@@ -276,7 +239,7 @@ spec:
labels:
app: oauth2-proxy-hermes-chat
annotations:
- ai.bstein.dev/config-rev: "20260809-expired-callback-recovery"
+ ai.bstein.dev/config-rev: "20260809-oauth2-proxy-7-15-canary"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/role: hermes-chat
@@ -292,7 +255,7 @@ spec:
automountServiceAccountToken: true
containers:
- name: oauth2-proxy
- image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d
+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
imagePullPolicy: IfNotPresent
args:
- --provider=oidc
@@ -311,6 +274,9 @@ spec:
- --cookie-path=/
- --cookie-secure=true
- --cookie-samesite=lax
+ - --cookie-csrf-expire=10m
+ - --cookie-csrf-per-request=true
+ - --cookie-csrf-per-request-limit=8
- --cookie-refresh=1h
- --cookie-expire=8h
- --custom-templates-dir=/etc/oauth2-proxy/templates
@@ -319,6 +285,7 @@ spec:
- --http-address=0.0.0.0:4180
- --skip-provider-button=true
- --reverse-proxy=true
+ - --trusted-proxy-ip=10.42.0.0/16
ports:
- {name: http, containerPort: 4180}
readinessProbe:
diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py
index 2287f0eba..f7850f871 100644
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@@ -104,16 +104,16 @@ def test_chat_oauth_allows_stale_service_worker_retirement():
assert "--skip-auth-route=GET=^/sw[.]js([?].*)?$" in args
assert "--custom-templates-dir=/etc/oauth2-proxy/templates" in args
- template = next(
- document
- for document in documents
- if document["kind"] == "ConfigMap"
- and document["metadata"]["name"] == "hermes-chat-oauth-templates"
- )["data"]["error.html"]
+ template = (HERMES / "oauth2-proxy-templates" / "error.html").read_text()
assert 'http-equiv="refresh"' in template
assert "Unable to find a valid CSRF token" in template
assert "expired or was already used" in template
assert "/sign_in?rd=/" in template
+ container = deployment["spec"]["template"]["spec"]["containers"][0]
+ assert "v7.15.3@sha256:10a1165743a192e" in container["image"]
+ assert "--cookie-csrf-per-request=true" in args
+ assert "--cookie-csrf-per-request-limit=8" in args
+ assert "--trusted-proxy-ip=10.42.0.0/16" in args
def test_chat_auth_file_mount_survives_atomic_provider_refresh():