From 07b64a0245320bdb81e8d4646e7196924fb9d9cc Mon Sep 17 00:00:00 2001 From: jenkins Date: Sat, 15 Aug 2026 14:45:27 -0300 Subject: [PATCH] hermes: expose Vault SSH config to OpenSSH --- services/hermes/agent-deployment.yaml | 7 +++++++ testing/tests/test_hermes_cli_lanes.py | 2 ++ 2 files changed, 9 insertions(+) diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml index c5beab82..1ea4cff4 100644 --- a/services/hermes/agent-deployment.yaml +++ b/services/hermes/agent-deployment.yaml @@ -130,6 +130,12 @@ spec: if [ ! -e /opt/data/home/.hermes ]; then ln -s /opt/data /opt/data/home/.hermes fi + # OpenSSH resolves ~/.ssh from the account's passwd home + # (/opt/data), not the HOME override used by Hermes. Keep one + # Vault-populated directory visible through both paths. + if [ ! -e /opt/data/.ssh ] && [ ! -L /opt/data/.ssh ]; then + ln -s home/.ssh /opt/data/.ssh + fi cp /config/config.yaml /opt/data/config.yaml cp /config/SOUL.md /opt/data/SOUL.md cp /config/AGENTS.md /opt/data/workspace/AGENTS.md @@ -143,6 +149,7 @@ spec: chmod 0600 \ /opt/data/home/.ssh/config \ /opt/data/home/.ssh/known_hosts + chmod 0700 /opt/data/home/.ssh touch "${env_file}" upsert_env() { key="$1" diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py index d9a68677..1f71b8d4 100644 --- a/testing/tests/test_hermes_cli_lanes.py +++ b/testing/tests/test_hermes_cli_lanes.py @@ -946,6 +946,8 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access(): "cp /vault/secrets/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts" in command ) + assert "ln -s home/.ssh /opt/data/.ssh" in command + assert "chmod 0700 /opt/data/home/.ssh" in command assert "chmod 0600 /opt/data/home/.ssh/id_ed25519_atlas_nodes" in command config = yaml.safe_load((HERMES / "agent-configmap.yaml").read_text())["data"]