titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into feature/hermes-direct-cli-lane-concurrency-2-replacement

Browse Source
This commit is contained in:
bstein 2026-08-21 07:57:35 +00:00
commit 66a537ddbe
24 changed files with 51 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dockerfiles/Dockerfile.hermes-agent
View File

@ -1526,7 +1526,7 @@ function replaceOnce(source, before, after, label) {
it to the shared Hermes bot from your Telegram account.
</p>
<a
href="https://chat.hermes.bstein.dev/telegram"
href="https://chat.bstein.dev/telegram"
className="mt-4 inline-flex rounded border border-current/30 px-4 py-2 text-sm font-medium text-midground hover:bg-midground/10"
>
Open Telegram setup

2
dockerfiles/hermes-public-extract/provider.py
View File

@ -65,7 +65,7 @@ def _fetch_public(url: str) -> tuple[str, str, str]:
"""Fetch one public URL with redirect, size, MIME, and policy checks."""
current = url
headers = {
"User-Agent": "HermesPrivateChat/1.0 (+https://chat.hermes.bstein.dev)",
"User-Agent": "HermesPrivateChat/1.0 (+https://chat.bstein.dev)",
"Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8",
}
with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client:

2
dockerfiles/hermes-webui-atlas-voice.js
View File

@ -1,4 +1,4 @@
// Natural turn-taking for chat.hermes.bstein.dev using the private Jetsons.
// Natural turn-taking for chat.bstein.dev using the private Jetsons.
(function(){
'use strict';

4
infrastructure/core/coredns-custom.yaml
View File

@ -18,7 +18,7 @@ data:
192.168.22.9 call.live.bstein.dev
192.168.22.9 cd.bstein.dev
192.168.22.9 chat.ai.bstein.dev
192.168.22.9 chat.hermes.bstein.dev
192.168.22.9 chat.bstein.dev
192.168.22.9 ci.bstein.dev
192.168.22.9 cloud.bstein.dev
192.168.22.9 health.bstein.dev
@ -45,7 +45,7 @@ data:
192.168.22.9 stream.bstein.dev
192.168.22.9 wolf.bstein.dev
192.168.22.9 tasks.bstein.dev
192.168.22.9 triage.hermes.bstein.dev
192.168.22.9 triage.bstein.dev
192.168.22.9 vault.bstein.dev
fallthrough
}

4
knowledge/catalog/atlas.json
View File

@ -4404,7 +4404,7 @@
}
},
{
"host": "chat.hermes.bstein.dev",
"host": "chat.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
@ -5164,7 +5164,7 @@
}
},
{
"host": "triage.hermes.bstein.dev",
"host": "triage.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",

4
knowledge/catalog/atlas.yaml
View File

@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress
name: bstein-dev-home
source: bstein-dev-home
- host: chat.hermes.bstein.dev
- host: chat.bstein.dev
path: /
backend:
namespace: hermes
@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress
name: planka
source: planka
- host: triage.hermes.bstein.dev
- host: triage.bstein.dev
path: /
backend:
namespace: hermes

8
knowledge/diagrams/atlas-http.mmd
View File

@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"]
host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"]
@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka
host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"]
host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"]

4
services/comms/knowledge/catalog/atlas.json
View File

@ -4404,7 +4404,7 @@
}
},
{
"host": "chat.hermes.bstein.dev",
"host": "chat.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
@ -5164,7 +5164,7 @@
}
},
{
"host": "triage.hermes.bstein.dev",
"host": "triage.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",

4
services/comms/knowledge/catalog/atlas.yaml
View File

@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress
name: bstein-dev-home
source: bstein-dev-home
- host: chat.hermes.bstein.dev
- host: chat.bstein.dev
path: /
backend:
namespace: hermes
@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress
name: planka
source: planka
- host: triage.hermes.bstein.dev
- host: triage.bstein.dev
path: /
backend:
namespace: hermes

8
services/comms/knowledge/diagrams/atlas-http.mmd
View File

@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"]
host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"]
@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka
host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"]
host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"]

6
services/hermes/NOTES.md
View File

@ -1,8 +1,8 @@
# Hermes on Atlas: operator guide
This is the mental model and demonstration script for the operator instance at
`triage.hermes.bstein.dev`. Read it once, then prove each section in the live UI. The
consumer instance at `chat.hermes.bstein.dev` is intentionally separate and is not the
`triage.bstein.dev`. Read it once, then prove each section in the live UI. The
consumer instance at `chat.bstein.dev` is intentionally separate and is not the
place to perform infrastructure triage.
`agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root
@ -14,7 +14,7 @@ its conversation-first layout is a better fit.
## Consumer chat and Telegram
`chat.hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator
`chat.bstein.dev` uses the pinned Hermes WebUI rather than the operator
dashboard. Keycloak still authenticates every browser request, and the tenant
router permanently assigns each Keycloak subject to one Hermes process and one
PVC. The four slots are an isolation pool, not a provider round robin: every

4
services/hermes/agent-certificate.yaml
View File

@ -11,5 +11,5 @@ spec:
name: letsencrypt
dnsNames:
- agent.hermes.bstein.dev
- chat.hermes.bstein.dev
- triage.hermes.bstein.dev
- chat.bstein.dev
- triage.bstein.dev

2
services/hermes/agent-configmap.yaml
View File

@ -322,7 +322,7 @@ data:
cannot read Secrets, exec or attach to pods, create service-account tokens,
mutate workloads or RBAC, or reconcile Flux. Put every durable cluster
change on a reviewed titan-iac branch. Never expose credentials in chat or
logs. Triage belongs at triage.hermes.bstein.dev.
logs. Triage belongs at triage.bstein.dev.
## Atlas engineering access

8
services/hermes/agent-ingress.yaml
View File

@ -88,11 +88,11 @@ spec:
tls:
- hosts:
- agent.hermes.bstein.dev
- chat.hermes.bstein.dev
- triage.hermes.bstein.dev
- chat.bstein.dev
- triage.bstein.dev
secretName: hermes-sites-tls
rules:
- host: chat.hermes.bstein.dev
- host: chat.bstein.dev
http:
paths:
- path: /
@ -102,7 +102,7 @@ spec:
name: oauth2-proxy-hermes-chat
port:
name: http
- host: triage.hermes.bstein.dev
- host: triage.bstein.dev
http:
paths:
- path: /

2
services/hermes/chat-configmap.yaml
View File

@ -68,7 +68,7 @@ data:
atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus}
atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b}
dashboard:
public_url: https://chat.hermes.bstein.dev
public_url: https://chat.bstein.dev
display:
compact: true
tool_progress: all

4
services/hermes/chat-statefulset.yaml
View File

@ -277,7 +277,7 @@ spec:
- {name: API_SERVER_ENABLED, value: "true"}
- {name: API_SERVER_HOST, value: 0.0.0.0}
- {name: API_SERVER_PORT, value: "8642"}
- {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev}
- {name: API_SERVER_CORS_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002}
- {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
- {name: HERMES_AUTO_ROUTER_PROFILE, value: chat}
@ -345,7 +345,7 @@ spec:
# NetworkPolicy admits this port only from hermes-chat-router; the
# CIDR lets the WebUI validate that router's changing pod address.
- {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.hermes.bstein.dev}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: chat}

6
services/hermes/configmap.yaml
View File

@ -83,7 +83,7 @@ data:
- "*kubectl describe secret*"
dashboard:
public_url: https://triage.hermes.bstein.dev
public_url: https://triage.bstein.dev
display:
compact: true
@ -111,10 +111,10 @@ data:
You are Hermes running inside the Titan Kubernetes cluster as a supervised
testing and operations triage assistant.
This is the dedicated triage appliance at triage.hermes.bstein.dev. Keep
This is the dedicated triage appliance at triage.bstein.dev. Keep
automated Ariadne intake and testing conversations here. Project delivery
and coding orchestration belong to agent.hermes.bstein.dev; general user
chat belongs to chat.hermes.bstein.dev.
chat belongs to chat.bstein.dev.
Start in AUTO routing with a careful, intelligence-biased posture. Every
new request is classified locally before a hosted model is selected. The

6
services/hermes/deployment.yaml
View File

@ -284,7 +284,7 @@ spec:
- name: HERMES_DASHBOARD
value: "0"
- name: HERMES_DASHBOARD_PUBLIC_URL
value: https://triage.hermes.bstein.dev
value: https://triage.bstein.dev
- name: API_SERVER_ENABLED
value: "true"
- name: API_SERVER_HOST
@ -292,7 +292,7 @@ spec:
- name: API_SERVER_PORT
value: "8642"
- name: API_SERVER_CORS_ORIGINS
value: https://triage.hermes.bstein.dev
value: https://triage.bstein.dev
- name: VICTORIA_METRICS_URL
value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428
- name: ARIADNE_BASE_URL
@ -405,7 +405,7 @@ spec:
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
- {name: HERMES_WEBUI_SECURE, value: "1"}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: triage}

4
services/hermes/oauth2-proxy.yaml
View File

@ -82,7 +82,7 @@ spec:
args:
- --provider=oidc
- --config=/vault/secrets/oidc-config
- --redirect-url=https://triage.hermes.bstein.dev/oauth2/callback
- --redirect-url=https://triage.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub
- --code-challenge-method=S256
@ -181,7 +181,7 @@ spec:
args:
- --provider=oidc
- --config=/vault/secrets/oidc-config
- --redirect-url=https://chat.hermes.bstein.dev/oauth2/callback
- --redirect-url=https://chat.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub
- --code-challenge-method=S256

4
services/hermes/router/telegram.go
View File

@ -249,7 +249,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
command, args := commandParts(message.Text)
if command == "start" || command == "link" {
if len(args) == 0 {
_ = bot.sendText(message.Chat.ID, "Sign in to chat.hermes.bstein.dev, open Telegram, and create a one-time link code.")
_ = bot.sendText(message.Chat.ID, "Sign in to chat.bstein.dev, open Telegram, and create a one-time link code.")
return
}
if _, err := bot.router.consumeLink(userID, args[0]); err != nil {
@ -273,7 +273,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
}
slot, linked := bot.router.telegramSlot(userID)
if !linked {
_ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.hermes.bstein.dev and open Telegram to connect it.")
_ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.bstein.dev and open Telegram to connect it.")
return
}
if command == "topic" {

4
services/hermes/skills/master-hermes-on-atlas/references/architecture.md
View File

@ -7,9 +7,9 @@ asserting health, placement, ownership, or current model availability.
| Surface | Purpose | Identity boundary | State and permissions |
| --- | --- | --- | --- |
| `triage.hermes.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
| `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
| `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
| `chat.hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
| `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
The instances do not share conversation state, credentials, profiles, skills
created on their PVCs, or Kubernetes identities. They share only the inference

4
services/keycloak/scripts/hermes_access_oidc_ensure.sh
View File

@ -327,8 +327,8 @@ ensure_telegram_config() {
}
ensure_hermes_owner
ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc"
ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc"
ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc"
ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc"
ensure_service_account_client "hermes-automation" "hermes/developer-keycloak"
ensure_telegram_config

2
services/maintenance/apps/ariadne-deployment.yaml
View File

@ -555,7 +555,7 @@ spec:
# open the run that wrote it rather than taking "Proposed by
# Hermes" on trust.
- name: ARIADNE_HERMES_UI_URL
value: https://triage.hermes.bstein.dev
value: https://triage.bstein.dev
- name: ARIADNE_HERMES_SONAR_ENABLED
value: "true"
- name: ARIADNE_HERMES_SONAR_URL

4
services/quality/zap-baseline-configmap.yaml
View File

@ -27,8 +27,8 @@ data:
https://money.bstein.dev
https://health.bstein.dev
https://agent.hermes.bstein.dev
https://chat.hermes.bstein.dev
https://triage.hermes.bstein.dev
https://chat.bstein.dev
https://triage.bstein.dev
https://cassandra.bstein.dev
https://veles.bstein.dev
https://matrix.live.bstein.dev