bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hermes: make Telegram setup actionable
Some checks failed
Tests / Declarative: Post Actions failed: 2, passed: 265
Details

Browse Source
This commit is contained in:
jenkins 2026-08-13 04:52:04 -03:00
parent 0590cefa9b
commit f0a1667b1a
4 changed files with 21 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
clusters/atlas/flux-system/applications/hermes/kustomization.yaml
View File

@ -30,10 +30,6 @@ spec:
kind: Deployment kind: Deployment
name: hermes name: hermes
namespace: hermes namespace: hermes
- apiVersion: apps/v1
kind: Deployment
name: hermes-agent
namespace: hermes
- apiVersion: apps/v1 - apiVersion: apps/v1
kind: StatefulSet kind: StatefulSet
name: hermes-chat-tenant name: hermes-chat-tenant

4
services/hermes/chat-router.yaml
View File

@ -20,7 +20,7 @@ spec:
app: hermes-chat-router app: hermes-chat-router
annotations: annotations:
ai.bstein.dev/role: privacy-preserving-chat-tenant-router ai.bstein.dev/role: privacy-preserving-chat-tenant-router
ai.bstein.dev/config-rev: "20260813-telegram-setup" ai.bstein.dev/config-rev: "20260813-telegram-operator-v2"
vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-init-first: "true"
@ -62,7 +62,7 @@ spec:
values: [rpi5] values: [rpi5]
containers: containers:
- name: router - name: router
image: registry.bstein.dev/bstein/hermes-chat-router@sha256:5e8fbc8f9f57e33c6fe1828a60f6e4f8f49cc0b9410a3d54abcb4219717fb168 image: registry.bstein.dev/bstein/hermes-chat-router@sha256:a8883cd4c21ae201807004548ecd052a96614ac1c4f7c40b7c7cb3f69ff62410
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
ports: ports:
- {name: http, containerPort: 8080, protocol: TCP} - {name: http, containerPort: 8080, protocol: TCP}

10
services/hermes/router/main_test.go
View File

@ -158,7 +158,15 @@ func TestTelegramPageExplainsOneTimeOperatorSetup(t *testing.T) {
t.Fatalf("got status %d", response.Code) t.Fatalf("got status %d", response.Code)
} }
body := response.Body.String() body := response.Body.String()
for _, expected := range []string{"https://t.me/BotFather", "kv/atlas/hermes/chat-telegram", "bot_token", "relay_key"} { for _, expected := range []string{
"https://t.me/BotFather",
"https://secret.bstein.dev",
"vault login -method=oidc",
"vault kv patch -mount=kv atlas/hermes/chat-telegram",
"bot_token",
"relay_key",
"each Keycloak user",
} {
if !strings.Contains(body, expected) { if !strings.Contains(body, expected) {
t.Fatalf("Telegram operator setup omitted %q", expected) t.Fatalf("Telegram operator setup omitted %q", expected)
} }

17
services/hermes/router/web.go
View File

@ -17,7 +17,7 @@ const telegramPage = `<!doctype html>
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1"> <meta name="viewport" content="width=device-width,initial-scale=1">
<title>Hermes on Telegram</title> <title>Hermes on Telegram</title>
<link rel="stylesheet" href="/hermes-chat-bridge.css?v=20260813-telegram-setup"> <link rel="stylesheet" href="/hermes-chat-bridge.css?v=20260813-telegram-operator-v2">
</head> </head>
<body class="hermes-link-page"> <body class="hermes-link-page">
<main class="hermes-link-card" data-telegram-page> <main class="hermes-link-card" data-telegram-page>
@ -35,14 +35,17 @@ const telegramPage = `<!doctype html>
<ol> <ol>
<li><a class="hermes-button primary" href="https://t.me/BotFather" target="_blank" rel="noopener noreferrer">Open @BotFather</a> and send <code>/newbot</code>.</li> <li><a class="hermes-button primary" href="https://t.me/BotFather" target="_blank" rel="noopener noreferrer">Open @BotFather</a> and send <code>/newbot</code>.</li>
<li>Choose the bot's display name and a username ending in <code>bot</code>, then copy the token BotFather returns.</li> <li>Choose the bot's display name and a username ending in <code>bot</code>, then copy the token BotFather returns.</li>
<li>Store the token in Vault at <code>kv/atlas/hermes/chat-telegram</code> under the <code>bot_token</code> key. Preserve the existing <code>relay_key</code>.</li> <li>On a trusted administrator computer with the Vault CLI, sign in to <a href="https://secret.bstein.dev" target="_blank" rel="noopener noreferrer">Atlas Vault</a> and store the token at <code>kv/atlas/hermes/chat-telegram</code> under <code>bot_token</code>.</li>
</ol> </ol>
<pre>vault kv patch -mount=kv atlas/hermes/chat-telegram bot_token='&lt;BOTFATHER_TOKEN&gt;'</pre> <pre>export VAULT_ADDR=https://secret.bstein.dev
<p><strong>Do not paste the token into Hermes or send it in a message.</strong> After it is saved, ask the Hermes operator to apply the tracked router rollout, then return here to link your account.</p> vault login -method=oidc
vault kv patch -mount=kv atlas/hermes/chat-telegram bot_token='&lt;BOTFATHER_TOKEN&gt;'</pre>
<p><code>vault kv patch</code> changes only <code>bot_token</code>, so it preserves the existing <code>relay_key</code>. <strong>Do not paste the token into Hermes, a browser form, Git, or a message.</strong></p>
<p>After the token is saved, ask the Hermes operator to apply the tracked router rollout. Then return here: the account-link button will appear and each Keycloak user can privately link their own Telegram account.</p>
</section> </section>
<p class="hermes-fine-print">Codes expire after 10 minutes. Only direct messages are accepted; group messages are ignored.</p> <p class="hermes-fine-print">Codes expire after 10 minutes. Only direct messages are accepted; group messages are ignored.</p>
</main> </main>
<script src="/hermes-chat-bridge.js?v=20260813-telegram-setup" defer></script> <script src="/hermes-chat-bridge.js?v=20260813-telegram-operator-v2" defer></script>
</body> </body>
</html>` </html>`
@ -52,7 +55,7 @@ const privateFilesPage = `<!doctype html>
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1"> <meta name="viewport" content="width=device-width,initial-scale=1">
<title>Hermes Private Files</title> <title>Hermes Private Files</title>
<link rel="stylesheet" href="/hermes-chat-bridge.css?v=20260813-telegram-setup"> <link rel="stylesheet" href="/hermes-chat-bridge.css?v=20260813-telegram-operator-v2">
</head> </head>
<body class="hermes-files-page"> <body class="hermes-files-page">
<main class="hermes-files-shell" data-files-page> <main class="hermes-files-shell" data-files-page>
@ -83,7 +86,7 @@ const privateFilesPage = `<!doctype html>
</section> </section>
</div> </div>
</main> </main>
<script src="/hermes-chat-bridge.js?v=20260813-telegram-setup" defer></script> <script src="/hermes-chat-bridge.js?v=20260813-telegram-operator-v2" defer></script>
</body> </body>
</html>` </html>`