fix(hermes): stabilize consumer chat transport

infrastructure/traefik/deployment.yaml

@@ -4,8 +4,6 @@ items:
 - apiVersion: apps/v1
   kind: Deployment
   metadata:
-    annotations:
-      deployment.kubernetes.io/revision: "4"
     name: traefik
     namespace: traefik
   spec:
@@ -73,6 +71,14 @@ items:
           node-role.kubernetes.io/worker: "true"
         affinity:
           nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+              - matchExpressions:
+                - key: hardware
+                  operator: In
+                  values:
+                  - rpi5
+                  - rpi4
             preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
               preference:
@@ -103,6 +109,12 @@ items:
                   operator: In
                   values:
                   - rpi4
+          podAntiAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: traefik
+              topologyKey: kubernetes.io/hostname
         restartPolicy: Always
         schedulerName: default-scheduler
         serviceAccount: atlas-traefik-ingress-controller

services/keycloak/oneoffs/hermes-access-oidc-client-job.yaml

@@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hermes-access-oidc-client-ensure-2
+  name: hermes-access-oidc-client-ensure-3
   namespace: sso
 spec:
   backoffLimit: 3

services/keycloak/scripts/hermes_access_oidc_ensure.sh

@@ -56,7 +56,8 @@ chat_payload="$(jq -nc \
     baseUrl:"/",
     attributes:{
       "pkce.code.challenge.method":"S256",
-      "post.logout.redirect.uris":$web_origin
+      "post.logout.redirect.uris":$web_origin,
+      "access.token.lifespan":"1200"
     }
   }')"