From 787bba2d33b5357ad892b8f409ab1d0f3d1d0c4b Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Thu, 20 Aug 2026 21:57:07 +0000 Subject: [PATCH] refactor(hermes): rename chat and triage public hostnames Rename two public Hermes hostnames across the repo: chat.hermes.bstein.dev -> hermes.bstein.dev triage.hermes.bstein.dev -> triage.bstein.dev agent.hermes.bstein.dev is left untouched. That rename ships separately and must merge last, because it is the coordinator's own access point. Covers CoreDNS host entries, the shared hermes-sites certificate SANs and the ingress rules, Keycloak OIDC redirect/origin/post-logout URLs, oauth2-proxy redirect URLs, CORS and allowed-origin settings, dashboard public URLs, the Ariadne proposal UI link, ZAP baseline scan targets, the operator and agent instruction text, the Telegram sign-in prompts, and the Docker/UI references. Knowledge catalogs and the HTTP diagram were regenerated with scripts/render/knowledge_render_atlas.py rather than hand-edited. Only the rename delta is carried here: the committed catalogs on main are already stale by roughly 1650 lines, and that drift is left for a separate cleanup. Repo-only change. After merge it needs the Keycloak ensure script re-run and certificate reissuance; existing oauth2-proxy sessions are invalidated. Co-Authored-By: Claude Opus 5 --- dockerfiles/Dockerfile.hermes-agent | 2 +- dockerfiles/hermes-public-extract/provider.py | 2 +- dockerfiles/hermes-webui-atlas-voice.js | 2 +- infrastructure/core/coredns-custom.yaml | 4 +- knowledge/catalog/atlas.json | 42 +++++++++---------- knowledge/catalog/atlas.yaml | 28 ++++++------- knowledge/diagrams/atlas-http.mmd | 14 +++---- services/comms/knowledge/catalog/atlas.json | 42 +++++++++---------- services/comms/knowledge/catalog/atlas.yaml | 28 ++++++------- .../comms/knowledge/diagrams/atlas-http.mmd | 14 +++---- services/hermes/NOTES.md | 8 ++-- services/hermes/agent-certificate.yaml | 4 +- services/hermes/agent-configmap.yaml | 2 +- services/hermes/agent-ingress.yaml | 8 ++-- services/hermes/chat-configmap.yaml | 2 +- services/hermes/chat-statefulset.yaml | 4 +- services/hermes/configmap.yaml | 10 ++--- services/hermes/deployment.yaml | 6 +-- services/hermes/oauth2-proxy.yaml | 4 +- services/hermes/router/telegram.go | 4 +- .../references/architecture.md | 4 +- .../scripts/hermes_access_oidc_ensure.sh | 4 +- .../maintenance/apps/ariadne-deployment.yaml | 2 +- services/quality/zap-baseline-configmap.yaml | 4 +- 24 files changed, 122 insertions(+), 122 deletions(-) diff --git a/dockerfiles/Dockerfile.hermes-agent b/dockerfiles/Dockerfile.hermes-agent index 35a2f463..d77d9af3 100644 --- a/dockerfiles/Dockerfile.hermes-agent +++ b/dockerfiles/Dockerfile.hermes-agent @@ -1526,7 +1526,7 @@ function replaceOnce(source, before, after, label) { it to the shared Hermes bot from your Telegram account.

Open Telegram setup diff --git a/dockerfiles/hermes-public-extract/provider.py b/dockerfiles/hermes-public-extract/provider.py index 1e97576c..af9340a1 100644 --- a/dockerfiles/hermes-public-extract/provider.py +++ b/dockerfiles/hermes-public-extract/provider.py @@ -65,7 +65,7 @@ def _fetch_public(url: str) -> tuple[str, str, str]: """Fetch one public URL with redirect, size, MIME, and policy checks.""" current = url headers = { - "User-Agent": "HermesPrivateChat/1.0 (+https://chat.hermes.bstein.dev)", + "User-Agent": "HermesPrivateChat/1.0 (+https://hermes.bstein.dev)", "Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8", } with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client: diff --git a/dockerfiles/hermes-webui-atlas-voice.js b/dockerfiles/hermes-webui-atlas-voice.js index e83c35b7..8d39135b 100644 --- a/dockerfiles/hermes-webui-atlas-voice.js +++ b/dockerfiles/hermes-webui-atlas-voice.js @@ -1,4 +1,4 @@ -// Natural turn-taking for chat.hermes.bstein.dev using the private Jetsons. +// Natural turn-taking for hermes.bstein.dev using the private Jetsons. (function(){ 'use strict'; diff --git a/infrastructure/core/coredns-custom.yaml b/infrastructure/core/coredns-custom.yaml index beda2f43..a79c7522 100644 --- a/infrastructure/core/coredns-custom.yaml +++ b/infrastructure/core/coredns-custom.yaml @@ -18,10 +18,10 @@ data: 192.168.22.9 call.live.bstein.dev 192.168.22.9 cd.bstein.dev 192.168.22.9 chat.ai.bstein.dev - 192.168.22.9 chat.hermes.bstein.dev 192.168.22.9 ci.bstein.dev 192.168.22.9 cloud.bstein.dev 192.168.22.9 health.bstein.dev + 192.168.22.9 hermes.bstein.dev 192.168.22.9 kit.live.bstein.dev 192.168.22.9 live.bstein.dev 192.168.22.9 logs.bstein.dev @@ -45,7 +45,7 @@ data: 192.168.22.9 stream.bstein.dev 192.168.22.9 wolf.bstein.dev 192.168.22.9 tasks.bstein.dev - 192.168.22.9 triage.hermes.bstein.dev + 192.168.22.9 triage.bstein.dev 192.168.22.9 vault.bstein.dev fallthrough } diff --git a/knowledge/catalog/atlas.json b/knowledge/catalog/atlas.json index 98628e38..f019730f 100644 --- a/knowledge/catalog/atlas.json +++ b/knowledge/catalog/atlas.json @@ -4403,26 +4403,6 @@ "source": "bstein-dev-home" } }, - { - "host": "chat.hermes.bstein.dev", - "path": "/", - "backend": { - "namespace": "hermes", - "service": "oauth2-proxy-hermes-chat", - "port": "http", - "workloads": [ - { - "kind": "Deployment", - "name": "oauth2-proxy-hermes-chat" - } - ] - }, - "via": { - "kind": "Ingress", - "name": "hermes-sites", - "source": "hermes" - } - }, { "host": "ci.bstein.dev", "path": "/", @@ -4483,6 +4463,26 @@ "source": "health" } }, + { + "host": "hermes.bstein.dev", + "path": "/", + "backend": { + "namespace": "hermes", + "service": "oauth2-proxy-hermes-chat", + "port": "http", + "workloads": [ + { + "kind": "Deployment", + "name": "oauth2-proxy-hermes-chat" + } + ] + }, + "via": { + "kind": "Ingress", + "name": "hermes-sites", + "source": "hermes" + } + }, { "host": "kit.live.bstein.dev", "path": "/livekit/jwt", @@ -5164,7 +5164,7 @@ } }, { - "host": "triage.hermes.bstein.dev", + "host": "triage.bstein.dev", "path": "/", "backend": { "namespace": "hermes", diff --git a/knowledge/catalog/atlas.yaml b/knowledge/catalog/atlas.yaml index 6e355e7f..e264230c 100644 --- a/knowledge/catalog/atlas.yaml +++ b/knowledge/catalog/atlas.yaml @@ -2888,19 +2888,6 @@ http_endpoints: kind: Ingress name: bstein-dev-home source: bstein-dev-home -- host: chat.hermes.bstein.dev - path: / - backend: - namespace: hermes - service: oauth2-proxy-hermes-chat - port: http - workloads: - - kind: Deployment - name: oauth2-proxy-hermes-chat - via: - kind: Ingress - name: hermes-sites - source: hermes - host: ci.bstein.dev path: / backend: @@ -2940,6 +2927,19 @@ http_endpoints: kind: Ingress name: wger source: health +- host: hermes.bstein.dev + path: / + backend: + namespace: hermes + service: oauth2-proxy-hermes-chat + port: http + workloads: + - kind: Deployment + name: oauth2-proxy-hermes-chat + via: + kind: Ingress + name: hermes-sites + source: hermes - host: kit.live.bstein.dev path: /livekit/jwt backend: @@ -3361,7 +3361,7 @@ http_endpoints: kind: Ingress name: planka source: planka -- host: triage.hermes.bstein.dev +- host: triage.bstein.dev path: / backend: namespace: hermes diff --git a/knowledge/diagrams/atlas-http.mmd b/knowledge/diagrams/atlas-http.mmd index 11b55c8a..1a6315a5 100644 --- a/knowledge/diagrams/atlas-http.mmd +++ b/knowledge/diagrams/atlas-http.mmd @@ -51,11 +51,6 @@ flowchart LR host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway - host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] - svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] - host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat - wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] - svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_ci_bstein_dev["ci.bstein.dev"] svc_jenkins_jenkins["jenkins/jenkins (Service)"] host_ci_bstein_dev --> svc_jenkins_jenkins @@ -71,6 +66,11 @@ flowchart LR host_health_bstein_dev --> svc_health_wger wl_health_wger["health/wger (Deployment)"] svc_health_wger --> wl_health_wger + host_hermes_bstein_dev["hermes.bstein.dev"] + svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] + host_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat + wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] + svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_kit_live_bstein_dev["kit.live.bstein.dev"] svc_comms_livekit_token_service["comms/livekit-token-service (Service)"] host_kit_live_bstein_dev --> svc_comms_livekit_token_service @@ -170,9 +170,9 @@ flowchart LR host_tasks_bstein_dev --> svc_planka_planka wl_planka_planka["planka/planka (Deployment)"] svc_planka_planka --> wl_planka_planka - host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] + host_triage_bstein_dev["triage.bstein.dev"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] - host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage + host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage host_vault_bstein_dev["vault.bstein.dev"] diff --git a/services/comms/knowledge/catalog/atlas.json b/services/comms/knowledge/catalog/atlas.json index 98628e38..f019730f 100644 --- a/services/comms/knowledge/catalog/atlas.json +++ b/services/comms/knowledge/catalog/atlas.json @@ -4403,26 +4403,6 @@ "source": "bstein-dev-home" } }, - { - "host": "chat.hermes.bstein.dev", - "path": "/", - "backend": { - "namespace": "hermes", - "service": "oauth2-proxy-hermes-chat", - "port": "http", - "workloads": [ - { - "kind": "Deployment", - "name": "oauth2-proxy-hermes-chat" - } - ] - }, - "via": { - "kind": "Ingress", - "name": "hermes-sites", - "source": "hermes" - } - }, { "host": "ci.bstein.dev", "path": "/", @@ -4483,6 +4463,26 @@ "source": "health" } }, + { + "host": "hermes.bstein.dev", + "path": "/", + "backend": { + "namespace": "hermes", + "service": "oauth2-proxy-hermes-chat", + "port": "http", + "workloads": [ + { + "kind": "Deployment", + "name": "oauth2-proxy-hermes-chat" + } + ] + }, + "via": { + "kind": "Ingress", + "name": "hermes-sites", + "source": "hermes" + } + }, { "host": "kit.live.bstein.dev", "path": "/livekit/jwt", @@ -5164,7 +5164,7 @@ } }, { - "host": "triage.hermes.bstein.dev", + "host": "triage.bstein.dev", "path": "/", "backend": { "namespace": "hermes", diff --git a/services/comms/knowledge/catalog/atlas.yaml b/services/comms/knowledge/catalog/atlas.yaml index 6e355e7f..e264230c 100644 --- a/services/comms/knowledge/catalog/atlas.yaml +++ b/services/comms/knowledge/catalog/atlas.yaml @@ -2888,19 +2888,6 @@ http_endpoints: kind: Ingress name: bstein-dev-home source: bstein-dev-home -- host: chat.hermes.bstein.dev - path: / - backend: - namespace: hermes - service: oauth2-proxy-hermes-chat - port: http - workloads: - - kind: Deployment - name: oauth2-proxy-hermes-chat - via: - kind: Ingress - name: hermes-sites - source: hermes - host: ci.bstein.dev path: / backend: @@ -2940,6 +2927,19 @@ http_endpoints: kind: Ingress name: wger source: health +- host: hermes.bstein.dev + path: / + backend: + namespace: hermes + service: oauth2-proxy-hermes-chat + port: http + workloads: + - kind: Deployment + name: oauth2-proxy-hermes-chat + via: + kind: Ingress + name: hermes-sites + source: hermes - host: kit.live.bstein.dev path: /livekit/jwt backend: @@ -3361,7 +3361,7 @@ http_endpoints: kind: Ingress name: planka source: planka -- host: triage.hermes.bstein.dev +- host: triage.bstein.dev path: / backend: namespace: hermes diff --git a/services/comms/knowledge/diagrams/atlas-http.mmd b/services/comms/knowledge/diagrams/atlas-http.mmd index 11b55c8a..1a6315a5 100644 --- a/services/comms/knowledge/diagrams/atlas-http.mmd +++ b/services/comms/knowledge/diagrams/atlas-http.mmd @@ -51,11 +51,6 @@ flowchart LR host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway - host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] - svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] - host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat - wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] - svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_ci_bstein_dev["ci.bstein.dev"] svc_jenkins_jenkins["jenkins/jenkins (Service)"] host_ci_bstein_dev --> svc_jenkins_jenkins @@ -71,6 +66,11 @@ flowchart LR host_health_bstein_dev --> svc_health_wger wl_health_wger["health/wger (Deployment)"] svc_health_wger --> wl_health_wger + host_hermes_bstein_dev["hermes.bstein.dev"] + svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] + host_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat + wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] + svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_kit_live_bstein_dev["kit.live.bstein.dev"] svc_comms_livekit_token_service["comms/livekit-token-service (Service)"] host_kit_live_bstein_dev --> svc_comms_livekit_token_service @@ -170,9 +170,9 @@ flowchart LR host_tasks_bstein_dev --> svc_planka_planka wl_planka_planka["planka/planka (Deployment)"] svc_planka_planka --> wl_planka_planka - host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] + host_triage_bstein_dev["triage.bstein.dev"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] - host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage + host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage host_vault_bstein_dev["vault.bstein.dev"] diff --git a/services/hermes/NOTES.md b/services/hermes/NOTES.md index ac0c4216..92ece168 100644 --- a/services/hermes/NOTES.md +++ b/services/hermes/NOTES.md @@ -1,9 +1,9 @@ # Hermes on Atlas: operator guide This is the mental model and demonstration script for the operator instance at -`triage.hermes.bstein.dev`. Read it once, then prove each section in the live UI. The -consumer instance at `chat.hermes.bstein.dev` is intentionally separate and is not the -place to perform infrastructure triage. +`triage.bstein.dev`. Read it once, then prove each section in the live UI. The +consumer instance at `hermes.bstein.dev` is intentionally separate and is not +the place to perform infrastructure triage. `agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root serves the stock Hermes dashboard, including embedded chat/TUI and the native @@ -14,7 +14,7 @@ its conversation-first layout is a better fit. ## Consumer chat and Telegram -`chat.hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator +`hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator dashboard. Keycloak still authenticates every browser request, and the tenant router permanently assigns each Keycloak subject to one Hermes process and one PVC. The four slots are an isolation pool, not a provider round robin: every diff --git a/services/hermes/agent-certificate.yaml b/services/hermes/agent-certificate.yaml index 486bab8b..bc1f76ef 100644 --- a/services/hermes/agent-certificate.yaml +++ b/services/hermes/agent-certificate.yaml @@ -11,5 +11,5 @@ spec: name: letsencrypt dnsNames: - agent.hermes.bstein.dev - - chat.hermes.bstein.dev - - triage.hermes.bstein.dev + - hermes.bstein.dev + - triage.bstein.dev diff --git a/services/hermes/agent-configmap.yaml b/services/hermes/agent-configmap.yaml index d339b8c2..946d02d7 100644 --- a/services/hermes/agent-configmap.yaml +++ b/services/hermes/agent-configmap.yaml @@ -320,7 +320,7 @@ data: cannot read Secrets, exec or attach to pods, create service-account tokens, mutate workloads or RBAC, or reconcile Flux. Put every durable cluster change on a reviewed titan-iac branch. Never expose credentials in chat or - logs. Triage belongs at triage.hermes.bstein.dev. + logs. Triage belongs at triage.bstein.dev. ## Atlas engineering access diff --git a/services/hermes/agent-ingress.yaml b/services/hermes/agent-ingress.yaml index 19ae39b7..b74ba0ba 100644 --- a/services/hermes/agent-ingress.yaml +++ b/services/hermes/agent-ingress.yaml @@ -88,11 +88,11 @@ spec: tls: - hosts: - agent.hermes.bstein.dev - - chat.hermes.bstein.dev - - triage.hermes.bstein.dev + - hermes.bstein.dev + - triage.bstein.dev secretName: hermes-sites-tls rules: - - host: chat.hermes.bstein.dev + - host: hermes.bstein.dev http: paths: - path: / @@ -102,7 +102,7 @@ spec: name: oauth2-proxy-hermes-chat port: name: http - - host: triage.hermes.bstein.dev + - host: triage.bstein.dev http: paths: - path: / diff --git a/services/hermes/chat-configmap.yaml b/services/hermes/chat-configmap.yaml index 75f2ae52..34ccca1e 100644 --- a/services/hermes/chat-configmap.yaml +++ b/services/hermes/chat-configmap.yaml @@ -68,7 +68,7 @@ data: atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus} atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b} dashboard: - public_url: https://chat.hermes.bstein.dev + public_url: https://hermes.bstein.dev display: compact: true tool_progress: all diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml index 244b18a6..2c554146 100644 --- a/services/hermes/chat-statefulset.yaml +++ b/services/hermes/chat-statefulset.yaml @@ -277,7 +277,7 @@ spec: - {name: API_SERVER_ENABLED, value: "true"} - {name: API_SERVER_HOST, value: 0.0.0.0} - {name: API_SERVER_PORT, value: "8642"} - - {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev} + - {name: API_SERVER_CORS_ORIGINS, value: https://hermes.bstein.dev} - {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002} - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key} - {name: HERMES_AUTO_ROUTER_PROFILE, value: chat} @@ -345,7 +345,7 @@ spec: # NetworkPolicy admits this port only from hermes-chat-router; the # CIDR lets the WebUI validate that router's changing pod address. - {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16} - - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.hermes.bstein.dev} + - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://hermes.bstein.dev} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_ROUTER_PROFILE, value: chat} diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml index 7d27e93c..2c0d3c2b 100644 --- a/services/hermes/configmap.yaml +++ b/services/hermes/configmap.yaml @@ -83,7 +83,7 @@ data: - "*kubectl describe secret*" dashboard: - public_url: https://triage.hermes.bstein.dev + public_url: https://triage.bstein.dev display: compact: true @@ -111,10 +111,10 @@ data: You are Hermes running inside the Titan Kubernetes cluster as a supervised testing and operations triage assistant. - This is the dedicated triage appliance at triage.hermes.bstein.dev. Keep - automated Ariadne intake and testing conversations here. Project delivery - and coding orchestration belong to agent.hermes.bstein.dev; general user - chat belongs to chat.hermes.bstein.dev. + This is the dedicated triage appliance at triage.bstein.dev. Keep automated + Ariadne intake and testing conversations here. Project delivery and coding + orchestration belong to agent.hermes.bstein.dev; general user chat belongs + to hermes.bstein.dev. Start in AUTO routing with a careful, intelligence-biased posture. Every new request is classified locally before a hosted model is selected. The diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml index 25b3ada3..15c55b71 100644 --- a/services/hermes/deployment.yaml +++ b/services/hermes/deployment.yaml @@ -284,7 +284,7 @@ spec: - name: HERMES_DASHBOARD value: "0" - name: HERMES_DASHBOARD_PUBLIC_URL - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: API_SERVER_ENABLED value: "true" - name: API_SERVER_HOST @@ -292,7 +292,7 @@ spec: - name: API_SERVER_PORT value: "8642" - name: API_SERVER_CORS_ORIGINS - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: VICTORIA_METRICS_URL value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428 - name: ARIADNE_BASE_URL @@ -405,7 +405,7 @@ spec: - {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"} - {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"} - {name: HERMES_WEBUI_SECURE, value: "1"} - - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev} + - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.bstein.dev} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_ROUTER_PROFILE, value: triage} diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml index 52dea326..b811a797 100644 --- a/services/hermes/oauth2-proxy.yaml +++ b/services/hermes/oauth2-proxy.yaml @@ -82,7 +82,7 @@ spec: args: - --provider=oidc - --config=/vault/secrets/oidc-config - - --redirect-url=https://triage.hermes.bstein.dev/oauth2/callback + - --redirect-url=https://triage.bstein.dev/oauth2/callback - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --user-id-claim=sub - --code-challenge-method=S256 @@ -181,7 +181,7 @@ spec: args: - --provider=oidc - --config=/vault/secrets/oidc-config - - --redirect-url=https://chat.hermes.bstein.dev/oauth2/callback + - --redirect-url=https://hermes.bstein.dev/oauth2/callback - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --user-id-claim=sub - --code-challenge-method=S256 diff --git a/services/hermes/router/telegram.go b/services/hermes/router/telegram.go index a2d591df..002fd717 100644 --- a/services/hermes/router/telegram.go +++ b/services/hermes/router/telegram.go @@ -249,7 +249,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) { command, args := commandParts(message.Text) if command == "start" || command == "link" { if len(args) == 0 { - _ = bot.sendText(message.Chat.ID, "Sign in to chat.hermes.bstein.dev, open Telegram, and create a one-time link code.") + _ = bot.sendText(message.Chat.ID, "Sign in to hermes.bstein.dev, open Telegram, and create a one-time link code.") return } if _, err := bot.router.consumeLink(userID, args[0]); err != nil { @@ -273,7 +273,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) { } slot, linked := bot.router.telegramSlot(userID) if !linked { - _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.hermes.bstein.dev and open Telegram to connect it.") + _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to hermes.bstein.dev and open Telegram to connect it.") return } if command == "topic" { diff --git a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md index 9ec70a10..fd490604 100644 --- a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md +++ b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md @@ -7,9 +7,9 @@ asserting health, placement, ownership, or current model availability. | Surface | Purpose | Identity boundary | State and permissions | | --- | --- | --- | --- | -| `triage.hermes.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints | +| `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints | | `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed | -| `chat.hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access | +| `hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access | The instances do not share conversation state, credentials, profiles, skills created on their PVCs, or Kubernetes identities. They share only the inference diff --git a/services/keycloak/scripts/hermes_access_oidc_ensure.sh b/services/keycloak/scripts/hermes_access_oidc_ensure.sh index 0ab9fbb0..0c1dff13 100755 --- a/services/keycloak/scripts/hermes_access_oidc_ensure.sh +++ b/services/keycloak/scripts/hermes_access_oidc_ensure.sh @@ -327,8 +327,8 @@ ensure_telegram_config() { } ensure_hermes_owner -ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc" +ensure_proxy_client "hermes-chat-proxy" "https://hermes.bstein.dev" "hermes/chat-oidc" ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc" -ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc" +ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc" ensure_service_account_client "hermes-automation" "hermes/developer-keycloak" ensure_telegram_config diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml index d58b342d..c456464b 100644 --- a/services/maintenance/apps/ariadne-deployment.yaml +++ b/services/maintenance/apps/ariadne-deployment.yaml @@ -555,7 +555,7 @@ spec: # open the run that wrote it rather than taking "Proposed by # Hermes" on trust. - name: ARIADNE_HERMES_UI_URL - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: ARIADNE_HERMES_SONAR_ENABLED value: "true" - name: ARIADNE_HERMES_SONAR_URL diff --git a/services/quality/zap-baseline-configmap.yaml b/services/quality/zap-baseline-configmap.yaml index 06bb82bb..75ffd8eb 100644 --- a/services/quality/zap-baseline-configmap.yaml +++ b/services/quality/zap-baseline-configmap.yaml @@ -27,8 +27,8 @@ data: https://money.bstein.dev https://health.bstein.dev https://agent.hermes.bstein.dev - https://chat.hermes.bstein.dev - https://triage.hermes.bstein.dev + https://hermes.bstein.dev + https://triage.bstein.dev https://cassandra.bstein.dev https://veles.bstein.dev https://matrix.live.bstein.dev