diff --git a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml index f7f9eab17..a0ca47b35 100644 --- a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml +++ b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml @@ -30,10 +30,6 @@ spec: kind: Deployment name: hermes namespace: hermes - - apiVersion: apps/v1 - kind: Deployment - name: hermes-agent - namespace: hermes - apiVersion: apps/v1 kind: StatefulSet name: hermes-chat-tenant diff --git a/services/hermes/chat-router.yaml b/services/hermes/chat-router.yaml index 09a5fc2d6..5bbb0be38 100644 --- a/services/hermes/chat-router.yaml +++ b/services/hermes/chat-router.yaml @@ -20,7 +20,7 @@ spec: app: hermes-chat-router annotations: ai.bstein.dev/role: privacy-preserving-chat-tenant-router - ai.bstein.dev/config-rev: "20260813-telegram-setup" + ai.bstein.dev/config-rev: "20260813-telegram-operator-v2" vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-init-first: "true" @@ -62,7 +62,7 @@ spec: values: [rpi5] containers: - name: router - image: registry.bstein.dev/bstein/hermes-chat-router@sha256:5e8fbc8f9f57e33c6fe1828a60f6e4f8f49cc0b9410a3d54abcb4219717fb168 + image: registry.bstein.dev/bstein/hermes-chat-router@sha256:a8883cd4c21ae201807004548ecd052a96614ac1c4f7c40b7c7cb3f69ff62410 imagePullPolicy: IfNotPresent ports: - {name: http, containerPort: 8080, protocol: TCP} diff --git a/services/hermes/router/main_test.go b/services/hermes/router/main_test.go index 7fb08ed5b..039d6ac1e 100644 --- a/services/hermes/router/main_test.go +++ b/services/hermes/router/main_test.go @@ -158,7 +158,15 @@ func TestTelegramPageExplainsOneTimeOperatorSetup(t *testing.T) { t.Fatalf("got status %d", response.Code) } body := response.Body.String() - for _, expected := range []string{"https://t.me/BotFather", "kv/atlas/hermes/chat-telegram", "bot_token", "relay_key"} { + for _, expected := range []string{ + "https://t.me/BotFather", + "https://secret.bstein.dev", + "vault login -method=oidc", + "vault kv patch -mount=kv atlas/hermes/chat-telegram", + "bot_token", + "relay_key", + "each Keycloak user", + } { if !strings.Contains(body, expected) { t.Fatalf("Telegram operator setup omitted %q", expected) } diff --git a/services/hermes/router/web.go b/services/hermes/router/web.go index e00e4d9de..7eb81f032 100644 --- a/services/hermes/router/web.go +++ b/services/hermes/router/web.go @@ -17,7 +17,7 @@ const telegramPage = ` Hermes on Telegram - +
@@ -35,14 +35,17 @@ const telegramPage = `
  1. Open @BotFather and send /newbot.
  2. Choose the bot's display name and a username ending in bot, then copy the token BotFather returns.
    3. -
  3. Store the token in Vault at kv/atlas/hermes/chat-telegram under the bot_token key. Preserve the existing relay_key.
    4. +
  4. On a trusted administrator computer with the Vault CLI, sign in to Atlas Vault and store the token at kv/atlas/hermes/chat-telegram under bot_token.
- 
vault kv patch -mount=kv atlas/hermes/chat-telegram bot_token='<BOTFATHER_TOKEN>'
-

Do not paste the token into Hermes or send it in a message. After it is saved, ask the Hermes operator to apply the tracked router rollout, then return here to link your account.

+ 
export VAULT_ADDR=https://secret.bstein.dev
+vault login -method=oidc
+vault kv patch -mount=kv atlas/hermes/chat-telegram bot_token='<BOTFATHER_TOKEN>'
+

vault kv patch changes only bot_token, so it preserves the existing relay_key. Do not paste the token into Hermes, a browser form, Git, or a message.

+

After the token is saved, ask the Hermes operator to apply the tracked router rollout. Then return here: the account-link button will appear and each Keycloak user can privately link their own Telegram account.

Codes expire after 10 minutes. Only direct messages are accepted; group messages are ignored.

- + ` @@ -52,7 +55,7 @@ const privateFilesPage = ` Hermes Private Files - +
@@ -83,7 +86,7 @@ const privateFilesPage = `
- + `