fix(hermes): use WebUI for control surfaces
This commit is contained in:
jenkins
parent
1cf80fc21a
commit
cfb40c2752
@ -227,9 +227,9 @@ spec:
|
||||
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/opt/hermes/.venv/bin/hermes]
|
||||
args: [gateway, run]
|
||||
args: [gateway, run, --no-supervise]
|
||||
ports:
|
||||
- {name: dashboard, containerPort: 9119, protocol: TCP}
|
||||
- {name: api, containerPort: 8642, protocol: TCP}
|
||||
env:
|
||||
- {name: HERMES_HOME, value: /opt/data}
|
||||
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
||||
@ -239,10 +239,12 @@ spec:
|
||||
- {name: HERDR_CONFIG_PATH, value: /opt/data/home/.config/herdr/config.toml}
|
||||
- {name: HERDR_SOCKET_PATH, value: /opt/data/herdr/herdr.sock}
|
||||
- {name: PATH, value: /opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}
|
||||
- {name: HERMES_DASHBOARD, value: "1"}
|
||||
- {name: HERMES_DASHBOARD_HOST, value: 0.0.0.0}
|
||||
- {name: HERMES_DASHBOARD_PORT, value: "9119"}
|
||||
- {name: HERMES_DASHBOARD, value: "0"}
|
||||
- {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://agent.hermes.bstein.dev}
|
||||
- {name: API_SERVER_ENABLED, value: "true"}
|
||||
- {name: API_SERVER_HOST, value: 0.0.0.0}
|
||||
- {name: API_SERVER_PORT, value: "8642"}
|
||||
- {name: API_SERVER_CORS_ORIGINS, value: https://agent.hermes.bstein.dev}
|
||||
volumeMounts:
|
||||
- {name: home, mountPath: /opt/data}
|
||||
- {name: provider-auth, mountPath: /shared-auth}
|
||||
@ -250,17 +252,17 @@ spec:
|
||||
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
||||
- {name: coordinator, mountPath: /opt/data/home/.local/bin/herdr-dispatch, subPath: herdr_dispatch.py, readOnly: true}
|
||||
startupProbe:
|
||||
httpGet: {path: /api/status, port: dashboard}
|
||||
tcpSocket: {port: api}
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 60
|
||||
readinessProbe:
|
||||
httpGet: {path: /api/status, port: dashboard}
|
||||
tcpSocket: {port: api}
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet: {path: /api/status, port: dashboard}
|
||||
tcpSocket: {port: api}
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
@ -273,6 +275,63 @@ spec:
|
||||
resources:
|
||||
requests: {cpu: 250m, memory: 512Mi}
|
||||
limits: {cpu: "2", memory: 4Gi}
|
||||
- name: webui
|
||||
image: registry.bstein.dev/bstein/hermes-webui@sha256:a771858bd668d25e19c74864baea5425101c8cd5215d1ba3a312f3312ce6c5e1
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/bin/sh, -ec]
|
||||
args:
|
||||
- |
|
||||
api_key="$(sed -n 's/^API_SERVER_KEY=//p' /opt/data/.env | tail -n 1)"
|
||||
test -n "${api_key}"
|
||||
export API_SERVER_KEY="${api_key}"
|
||||
export HERMES_WEBUI_GATEWAY_API_KEY="${api_key}"
|
||||
exec /opt/hermes/.venv/bin/python /opt/hermes-webui/server.py
|
||||
ports:
|
||||
- {name: dashboard, containerPort: 8787, protocol: TCP}
|
||||
env:
|
||||
- {name: HERMES_HOME, value: /opt/data}
|
||||
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
||||
- {name: HOME, value: /opt/data/home}
|
||||
- {name: HERMES_WEBUI_AGENT_DIR, value: /opt/hermes}
|
||||
- {name: HERMES_WEBUI_HOST, value: 0.0.0.0}
|
||||
- {name: HERMES_WEBUI_PORT, value: "8787"}
|
||||
- {name: HERMES_WEBUI_STATE_DIR, value: /opt/data/webui}
|
||||
- {name: HERMES_WEBUI_DEFAULT_WORKSPACE, value: /opt/data/workspace}
|
||||
- {name: HERMES_WEBUI_CHAT_BACKEND, value: gateway}
|
||||
- {name: HERMES_WEBUI_GATEWAY_BASE_URL, value: http://127.0.0.1:8642}
|
||||
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
|
||||
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
|
||||
- {name: HERMES_WEBUI_SECURE, value: "1"}
|
||||
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://agent.hermes.bstein.dev}
|
||||
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
|
||||
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
|
||||
volumeMounts:
|
||||
- {name: home, mountPath: /opt/data}
|
||||
- {name: provider-auth, mountPath: /shared-auth, readOnly: true}
|
||||
- {name: tmp, mountPath: /tmp}
|
||||
readinessProbe:
|
||||
httpGet: {path: /health, port: dashboard}
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet: {path: /health, port: dashboard}
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10000
|
||||
runAsGroup: 10000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 750m, memory: 1Gi}
|
||||
- name: herdr-server
|
||||
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
||||
imagePullPolicy: IfNotPresent
|
||||
@ -351,3 +410,6 @@ spec:
|
||||
defaultMode: 0555
|
||||
- name: auth-patch
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
|
||||
@ -242,13 +242,11 @@ spec:
|
||||
args:
|
||||
- gateway
|
||||
- run
|
||||
- --no-supervise
|
||||
ports:
|
||||
- name: api
|
||||
containerPort: 8642
|
||||
protocol: TCP
|
||||
- name: dashboard
|
||||
containerPort: 9119
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: HERMES_HOME
|
||||
value: /opt/data
|
||||
@ -259,11 +257,7 @@ spec:
|
||||
- name: PATH
|
||||
value: /opt/data/home/.local/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
- name: HERMES_DASHBOARD
|
||||
value: "1"
|
||||
- name: HERMES_DASHBOARD_HOST
|
||||
value: 0.0.0.0
|
||||
- name: HERMES_DASHBOARD_PORT
|
||||
value: "9119"
|
||||
value: "0"
|
||||
- name: HERMES_DASHBOARD_PUBLIC_URL
|
||||
value: https://triage.hermes.bstein.dev
|
||||
- name: API_SERVER_ENABLED
|
||||
@ -325,23 +319,20 @@ spec:
|
||||
mountPath: /opt/data/workspace/skills/tune-atlas-alerts
|
||||
readOnly: true
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
tcpSocket:
|
||||
port: api
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 60
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
tcpSocket:
|
||||
port: api
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: dashboard
|
||||
tcpSocket:
|
||||
port: api
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
@ -352,6 +343,63 @@ spec:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
- name: webui
|
||||
image: registry.bstein.dev/bstein/hermes-webui@sha256:a771858bd668d25e19c74864baea5425101c8cd5215d1ba3a312f3312ce6c5e1
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/bin/sh, -ec]
|
||||
args:
|
||||
- |
|
||||
api_key="$(sed -n 's/^API_SERVER_KEY=//p' /opt/data/.env | tail -n 1)"
|
||||
test -n "${api_key}"
|
||||
export API_SERVER_KEY="${api_key}"
|
||||
export HERMES_WEBUI_GATEWAY_API_KEY="${api_key}"
|
||||
exec /opt/hermes/.venv/bin/python /opt/hermes-webui/server.py
|
||||
ports:
|
||||
- {name: dashboard, containerPort: 8787, protocol: TCP}
|
||||
env:
|
||||
- {name: HERMES_HOME, value: /opt/data}
|
||||
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
||||
- {name: HOME, value: /opt/data/home}
|
||||
- {name: HERMES_WEBUI_AGENT_DIR, value: /opt/hermes}
|
||||
- {name: HERMES_WEBUI_HOST, value: 0.0.0.0}
|
||||
- {name: HERMES_WEBUI_PORT, value: "8787"}
|
||||
- {name: HERMES_WEBUI_STATE_DIR, value: /opt/data/webui}
|
||||
- {name: HERMES_WEBUI_DEFAULT_WORKSPACE, value: /opt/data/workspace}
|
||||
- {name: HERMES_WEBUI_CHAT_BACKEND, value: gateway}
|
||||
- {name: HERMES_WEBUI_GATEWAY_BASE_URL, value: http://127.0.0.1:8642}
|
||||
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
|
||||
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
|
||||
- {name: HERMES_WEBUI_SECURE, value: "1"}
|
||||
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev}
|
||||
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
|
||||
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
|
||||
volumeMounts:
|
||||
- {name: home, mountPath: /opt/data}
|
||||
- {name: provider-auth, mountPath: /shared-auth, readOnly: true}
|
||||
- {name: tmp, mountPath: /tmp}
|
||||
readinessProbe:
|
||||
httpGet: {path: /health, port: dashboard}
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet: {path: /health, port: dashboard}
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10000
|
||||
runAsGroup: 10000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 128Mi}
|
||||
limits: {cpu: 750m, memory: 1Gi}
|
||||
volumes:
|
||||
- name: home
|
||||
persistentVolumeClaim:
|
||||
@ -373,6 +421,9 @@ spec:
|
||||
defaultMode: 0555
|
||||
- name: auth-patch
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
- name: triage-skill
|
||||
configMap:
|
||||
name: hermes-triage-skill
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user