titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

hermes: expose Vault SSH config to OpenSSH

Browse Source
This commit is contained in:
jenkins 2026-08-15 14:45:27 -03:00
parent 1ee766bc1e
commit 07b64a0245
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
services/hermes/agent-deployment.yaml
View File

@ -130,6 +130,12 @@ spec:
if [ ! -e /opt/data/home/.hermes ]; then
ln -s /opt/data /opt/data/home/.hermes
fi
# OpenSSH resolves ~/.ssh from the account's passwd home
# (/opt/data), not the HOME override used by Hermes. Keep one
# Vault-populated directory visible through both paths.
if [ ! -e /opt/data/.ssh ] && [ ! -L /opt/data/.ssh ]; then
ln -s home/.ssh /opt/data/.ssh
fi
cp /config/config.yaml /opt/data/config.yaml
cp /config/SOUL.md /opt/data/SOUL.md
cp /config/AGENTS.md /opt/data/workspace/AGENTS.md
@ -143,6 +149,7 @@ spec:
chmod 0600 \
/opt/data/home/.ssh/config \
/opt/data/home/.ssh/known_hosts
chmod 0700 /opt/data/home/.ssh
touch "${env_file}"
upsert_env() {
key="$1"

2
testing/tests/test_hermes_cli_lanes.py
View File

@ -946,6 +946,8 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
"cp /vault/secrets/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts"
in command
)
assert "ln -s home/.ssh /opt/data/.ssh" in command
assert "chmod 0700 /opt/data/home/.ssh" in command
assert "chmod 0600 /opt/data/home/.ssh/id_ed25519_atlas_nodes" in command
config = yaml.safe_load((HERMES / "agent-configmap.yaml").read_text())["data"]