143 lines
4.4 KiB
YAML
143 lines
4.4 KiB
YAML
# services/hermes-chat/configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: hermes-chat-config
|
|
namespace: hermes-chat
|
|
labels:
|
|
app: hermes-chat
|
|
data:
|
|
config.yaml: |
|
|
model:
|
|
provider: custom
|
|
default: gpt-oss:20b
|
|
model: gpt-oss:20b
|
|
context_length: 64000
|
|
base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
|
|
api_key: ollama
|
|
|
|
fallback_providers:
|
|
- provider: openai-codex
|
|
model: gpt-5.4
|
|
|
|
agent:
|
|
api_max_retries: 1
|
|
|
|
skills:
|
|
creation_nudge_interval: 15
|
|
external_dirs:
|
|
- /opt/data/workspace/skills
|
|
|
|
terminal:
|
|
backend: local
|
|
cwd: /opt/data/workspace
|
|
timeout: 180
|
|
home_mode: profile
|
|
|
|
approvals:
|
|
mode: manual
|
|
deny:
|
|
- "*kubectl apply*"
|
|
- "*kubectl create*"
|
|
- "*kubectl delete*"
|
|
- "*kubectl edit*"
|
|
- "*kubectl patch*"
|
|
- "*kubectl replace*"
|
|
- "*kubectl scale*"
|
|
- "*kubectl set*"
|
|
- "*kubectl label*"
|
|
- "*kubectl annotate*"
|
|
- "*kubectl cordon*"
|
|
- "*kubectl uncordon*"
|
|
- "*kubectl drain*"
|
|
- "*kubectl rollout restart*"
|
|
- "*kubectl rollout undo*"
|
|
- "*kubectl exec*"
|
|
- "*kubectl attach*"
|
|
- "*kubectl cp*"
|
|
- "*kubectl debug*"
|
|
- "*kubectl expose*"
|
|
- "*kubectl port-forward*"
|
|
- "*kubectl proxy*"
|
|
- "*kubectl run*"
|
|
- "*kubectl get secret*"
|
|
- "*kubectl describe secret*"
|
|
- "*flux reconcile*"
|
|
- "*flux suspend*"
|
|
- "*flux resume*"
|
|
- "*vault *"
|
|
- "*k3s *"
|
|
- "*crictl *"
|
|
- "*ctr *"
|
|
- "*169.254.169.254*"
|
|
- "*kubernetes.default*"
|
|
- "*/var/run/secrets/kubernetes.io*"
|
|
|
|
dashboard:
|
|
public_url: https://chat.bstein.dev
|
|
oauth:
|
|
provider: self-hosted
|
|
self_hosted:
|
|
issuer: https://sso.bstein.dev/realms/atlas
|
|
client_id: hermes-chat-dashboard
|
|
scopes: openid profile email groups
|
|
|
|
display:
|
|
compact: true
|
|
tool_progress: all
|
|
interim_assistant_messages: true
|
|
long_running_notifications: true
|
|
|
|
tool_loop_guardrails:
|
|
warnings_enabled: true
|
|
hard_stop_enabled: true
|
|
warn_after:
|
|
exact_failure: 2
|
|
same_tool_failure: 3
|
|
idempotent_no_progress: 2
|
|
hard_stop_after:
|
|
exact_failure: 5
|
|
same_tool_failure: 8
|
|
idempotent_no_progress: 5
|
|
|
|
updates:
|
|
pre_update_backup: quick
|
|
backup_keep: 3
|
|
non_interactive_local_changes: stash
|
|
SOUL.md: |
|
|
You are a personal AI assistant and researcher for Atlas users. Be useful,
|
|
curious, careful, and direct. Help with research, writing, planning,
|
|
learning, files, personal automation, and creative work. Use tools when
|
|
they materially improve the answer and make reusable skills when a stable
|
|
workflow is worth keeping.
|
|
|
|
Your environment is a private consumer sandbox. Work in the mounted
|
|
workspace and with public Internet services the user intentionally asks
|
|
you to use. You may inspect the Titan cluster through the dedicated
|
|
read-only Kubernetes identity to explain health and status. You do not
|
|
administer it: never attempt mutations, secret access, exec, attach,
|
|
port-forwarding, private-service access, or cloud metadata access.
|
|
AGENTS.md: |
|
|
# Personal Hermes workspace
|
|
|
|
This Hermes instance is a personal chat, research, and automation
|
|
environment. User-created files and skills belong under `/opt/data/workspace`.
|
|
|
|
You may:
|
|
|
|
- research public Internet sources and cite them
|
|
- create, read, and edit files in the workspace
|
|
- create and improve reusable skills
|
|
- configure user-owned channels and provider integrations
|
|
- run ordinary local commands needed for the user's task
|
|
- inspect non-secret Kubernetes resources and pod logs with read-only
|
|
`kubectl get`, `describe`, and `logs` commands
|
|
|
|
This container is not an infrastructure administration environment. The
|
|
Kubernetes identity is observation-only and cannot read Secrets or use pod
|
|
exec, attach, or port-forwarding. Do not attempt cluster mutations, private
|
|
service access, node LAN access, metadata services, Vault, container
|
|
runtimes, or the operator Hermes instance. If a request needs an action,
|
|
explain the evidence and say Brad must perform it from the operator
|
|
instance at `agent.bstein.dev`.
|