From 79be4d1c7137c8ee92c957e8b597c87a5c0b24af Mon Sep 17 00:00:00 2001
From: Hermes Agent
Date: Fri, 21 Aug 2026 06:43:18 +0000
Subject: [PATCH] refactor(hermes): rename chat and triage public hosts
---
dockerfiles/Dockerfile.hermes-agent | 2 +-
dockerfiles/hermes-public-extract/provider.py | 2 +-
dockerfiles/hermes-webui-atlas-voice.js | 2 +-
infrastructure/core/coredns-custom.yaml | 4 ++--
knowledge/catalog/atlas.json | 4 ++--
knowledge/catalog/atlas.yaml | 4 ++--
knowledge/diagrams/atlas-http.mmd | 8 ++++----
services/comms/knowledge/catalog/atlas.json | 4 ++--
services/comms/knowledge/catalog/atlas.yaml | 4 ++--
services/comms/knowledge/diagrams/atlas-http.mmd | 8 ++++----
services/hermes/NOTES.md | 6 +++---
services/hermes/agent-certificate.yaml | 4 ++--
services/hermes/agent-configmap.yaml | 2 +-
services/hermes/agent-ingress.yaml | 8 ++++----
services/hermes/chat-configmap.yaml | 2 +-
services/hermes/chat-statefulset.yaml | 4 ++--
services/hermes/configmap.yaml | 6 +++---
services/hermes/deployment.yaml | 6 +++---
services/hermes/oauth2-proxy.yaml | 4 ++--
services/hermes/router/telegram.go | 4 ++--
.../master-hermes-on-atlas/references/architecture.md | 4 ++--
services/keycloak/scripts/hermes_access_oidc_ensure.sh | 4 ++--
services/maintenance/apps/ariadne-deployment.yaml | 2 +-
services/quality/zap-baseline-configmap.yaml | 4 ++--
24 files changed, 51 insertions(+), 51 deletions(-)
diff --git a/dockerfiles/Dockerfile.hermes-agent b/dockerfiles/Dockerfile.hermes-agent
index 35a2f463..4f41fec2 100644
--- a/dockerfiles/Dockerfile.hermes-agent
+++ b/dockerfiles/Dockerfile.hermes-agent
@@ -1526,7 +1526,7 @@ function replaceOnce(source, before, after, label) {
it to the shared Hermes bot from your Telegram account.
Open Telegram setup
diff --git a/dockerfiles/hermes-public-extract/provider.py b/dockerfiles/hermes-public-extract/provider.py
index 1e97576c..631fec56 100644
--- a/dockerfiles/hermes-public-extract/provider.py
+++ b/dockerfiles/hermes-public-extract/provider.py
@@ -65,7 +65,7 @@ def _fetch_public(url: str) -> tuple[str, str, str]:
"""Fetch one public URL with redirect, size, MIME, and policy checks."""
current = url
headers = {
- "User-Agent": "HermesPrivateChat/1.0 (+https://chat.hermes.bstein.dev)",
+ "User-Agent": "HermesPrivateChat/1.0 (+https://chat.bstein.dev)",
"Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8",
}
with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client:
diff --git a/dockerfiles/hermes-webui-atlas-voice.js b/dockerfiles/hermes-webui-atlas-voice.js
index 707e3457..29cbf0a1 100644
--- a/dockerfiles/hermes-webui-atlas-voice.js
+++ b/dockerfiles/hermes-webui-atlas-voice.js
@@ -1,4 +1,4 @@
-// Natural turn-taking for chat.hermes.bstein.dev using the private Jetsons.
+// Natural turn-taking for chat.bstein.dev using the private Jetsons.
(function(){
'use strict';
diff --git a/infrastructure/core/coredns-custom.yaml b/infrastructure/core/coredns-custom.yaml
index beda2f43..0f39506f 100644
--- a/infrastructure/core/coredns-custom.yaml
+++ b/infrastructure/core/coredns-custom.yaml
@@ -18,7 +18,7 @@ data:
192.168.22.9 call.live.bstein.dev
192.168.22.9 cd.bstein.dev
192.168.22.9 chat.ai.bstein.dev
- 192.168.22.9 chat.hermes.bstein.dev
+ 192.168.22.9 chat.bstein.dev
192.168.22.9 ci.bstein.dev
192.168.22.9 cloud.bstein.dev
192.168.22.9 health.bstein.dev
@@ -45,7 +45,7 @@ data:
192.168.22.9 stream.bstein.dev
192.168.22.9 wolf.bstein.dev
192.168.22.9 tasks.bstein.dev
- 192.168.22.9 triage.hermes.bstein.dev
+ 192.168.22.9 triage.bstein.dev
192.168.22.9 vault.bstein.dev
fallthrough
}
diff --git a/knowledge/catalog/atlas.json b/knowledge/catalog/atlas.json
index 98628e38..d7247bfd 100644
--- a/knowledge/catalog/atlas.json
+++ b/knowledge/catalog/atlas.json
@@ -4404,7 +4404,7 @@
}
},
{
- "host": "chat.hermes.bstein.dev",
+ "host": "chat.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
@@ -5164,7 +5164,7 @@
}
},
{
- "host": "triage.hermes.bstein.dev",
+ "host": "triage.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
diff --git a/knowledge/catalog/atlas.yaml b/knowledge/catalog/atlas.yaml
index 6e355e7f..8ae1b49b 100644
--- a/knowledge/catalog/atlas.yaml
+++ b/knowledge/catalog/atlas.yaml
@@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress
name: bstein-dev-home
source: bstein-dev-home
-- host: chat.hermes.bstein.dev
+- host: chat.bstein.dev
path: /
backend:
namespace: hermes
@@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress
name: planka
source: planka
-- host: triage.hermes.bstein.dev
+- host: triage.bstein.dev
path: /
backend:
namespace: hermes
diff --git a/knowledge/diagrams/atlas-http.mmd b/knowledge/diagrams/atlas-http.mmd
index 11b55c8a..5c0c9be7 100644
--- a/knowledge/diagrams/atlas-http.mmd
+++ b/knowledge/diagrams/atlas-http.mmd
@@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
- host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"]
+ host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
- host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
+ host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"]
@@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka
- host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"]
+ host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
- host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
+ host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"]
diff --git a/services/comms/knowledge/catalog/atlas.json b/services/comms/knowledge/catalog/atlas.json
index 98628e38..d7247bfd 100644
--- a/services/comms/knowledge/catalog/atlas.json
+++ b/services/comms/knowledge/catalog/atlas.json
@@ -4404,7 +4404,7 @@
}
},
{
- "host": "chat.hermes.bstein.dev",
+ "host": "chat.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
@@ -5164,7 +5164,7 @@
}
},
{
- "host": "triage.hermes.bstein.dev",
+ "host": "triage.bstein.dev",
"path": "/",
"backend": {
"namespace": "hermes",
diff --git a/services/comms/knowledge/catalog/atlas.yaml b/services/comms/knowledge/catalog/atlas.yaml
index 6e355e7f..8ae1b49b 100644
--- a/services/comms/knowledge/catalog/atlas.yaml
+++ b/services/comms/knowledge/catalog/atlas.yaml
@@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress
name: bstein-dev-home
source: bstein-dev-home
-- host: chat.hermes.bstein.dev
+- host: chat.bstein.dev
path: /
backend:
namespace: hermes
@@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress
name: planka
source: planka
-- host: triage.hermes.bstein.dev
+- host: triage.bstein.dev
path: /
backend:
namespace: hermes
diff --git a/services/comms/knowledge/diagrams/atlas-http.mmd b/services/comms/knowledge/diagrams/atlas-http.mmd
index 11b55c8a..5c0c9be7 100644
--- a/services/comms/knowledge/diagrams/atlas-http.mmd
+++ b/services/comms/knowledge/diagrams/atlas-http.mmd
@@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
- host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"]
+ host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
- host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
+ host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"]
@@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka
- host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"]
+ host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
- host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
+ host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"]
diff --git a/services/hermes/NOTES.md b/services/hermes/NOTES.md
index ac0c4216..ef10bb65 100644
--- a/services/hermes/NOTES.md
+++ b/services/hermes/NOTES.md
@@ -1,8 +1,8 @@
# Hermes on Atlas: operator guide
This is the mental model and demonstration script for the operator instance at
-`triage.hermes.bstein.dev`. Read it once, then prove each section in the live UI. The
-consumer instance at `chat.hermes.bstein.dev` is intentionally separate and is not the
+`triage.bstein.dev`. Read it once, then prove each section in the live UI. The
+consumer instance at `chat.bstein.dev` is intentionally separate and is not the
place to perform infrastructure triage.
`agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root
@@ -14,7 +14,7 @@ its conversation-first layout is a better fit.
## Consumer chat and Telegram
-`chat.hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator
+`chat.bstein.dev` uses the pinned Hermes WebUI rather than the operator
dashboard. Keycloak still authenticates every browser request, and the tenant
router permanently assigns each Keycloak subject to one Hermes process and one
PVC. The four slots are an isolation pool, not a provider round robin: every
diff --git a/services/hermes/agent-certificate.yaml b/services/hermes/agent-certificate.yaml
index 486bab8b..0733bc83 100644
--- a/services/hermes/agent-certificate.yaml
+++ b/services/hermes/agent-certificate.yaml
@@ -11,5 +11,5 @@ spec:
name: letsencrypt
dnsNames:
- agent.hermes.bstein.dev
- - chat.hermes.bstein.dev
- - triage.hermes.bstein.dev
+ - chat.bstein.dev
+ - triage.bstein.dev
diff --git a/services/hermes/agent-configmap.yaml b/services/hermes/agent-configmap.yaml
index 9380c81f..bcec67ac 100644
--- a/services/hermes/agent-configmap.yaml
+++ b/services/hermes/agent-configmap.yaml
@@ -322,7 +322,7 @@ data:
cannot read Secrets, exec or attach to pods, create service-account tokens,
mutate workloads or RBAC, or reconcile Flux. Put every durable cluster
change on a reviewed titan-iac branch. Never expose credentials in chat or
- logs. Triage belongs at triage.hermes.bstein.dev.
+ logs. Triage belongs at triage.bstein.dev.
## Atlas engineering access
diff --git a/services/hermes/agent-ingress.yaml b/services/hermes/agent-ingress.yaml
index 19ae39b7..8d636d20 100644
--- a/services/hermes/agent-ingress.yaml
+++ b/services/hermes/agent-ingress.yaml
@@ -88,11 +88,11 @@ spec:
tls:
- hosts:
- agent.hermes.bstein.dev
- - chat.hermes.bstein.dev
- - triage.hermes.bstein.dev
+ - chat.bstein.dev
+ - triage.bstein.dev
secretName: hermes-sites-tls
rules:
- - host: chat.hermes.bstein.dev
+ - host: chat.bstein.dev
http:
paths:
- path: /
@@ -102,7 +102,7 @@ spec:
name: oauth2-proxy-hermes-chat
port:
name: http
- - host: triage.hermes.bstein.dev
+ - host: triage.bstein.dev
http:
paths:
- path: /
diff --git a/services/hermes/chat-configmap.yaml b/services/hermes/chat-configmap.yaml
index 75f2ae52..1ac6e20b 100644
--- a/services/hermes/chat-configmap.yaml
+++ b/services/hermes/chat-configmap.yaml
@@ -68,7 +68,7 @@ data:
atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus}
atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b}
dashboard:
- public_url: https://chat.hermes.bstein.dev
+ public_url: https://chat.bstein.dev
display:
compact: true
tool_progress: all
diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml
index 244b18a6..38756cf7 100644
--- a/services/hermes/chat-statefulset.yaml
+++ b/services/hermes/chat-statefulset.yaml
@@ -277,7 +277,7 @@ spec:
- {name: API_SERVER_ENABLED, value: "true"}
- {name: API_SERVER_HOST, value: 0.0.0.0}
- {name: API_SERVER_PORT, value: "8642"}
- - {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev}
+ - {name: API_SERVER_CORS_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002}
- {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
- {name: HERMES_AUTO_ROUTER_PROFILE, value: chat}
@@ -345,7 +345,7 @@ spec:
# NetworkPolicy admits this port only from hermes-chat-router; the
# CIDR lets the WebUI validate that router's changing pod address.
- {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16}
- - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.hermes.bstein.dev}
+ - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: chat}
diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml
index 7d27e93c..722ce75c 100644
--- a/services/hermes/configmap.yaml
+++ b/services/hermes/configmap.yaml
@@ -83,7 +83,7 @@ data:
- "*kubectl describe secret*"
dashboard:
- public_url: https://triage.hermes.bstein.dev
+ public_url: https://triage.bstein.dev
display:
compact: true
@@ -111,10 +111,10 @@ data:
You are Hermes running inside the Titan Kubernetes cluster as a supervised
testing and operations triage assistant.
- This is the dedicated triage appliance at triage.hermes.bstein.dev. Keep
+ This is the dedicated triage appliance at triage.bstein.dev. Keep
automated Ariadne intake and testing conversations here. Project delivery
and coding orchestration belong to agent.hermes.bstein.dev; general user
- chat belongs to chat.hermes.bstein.dev.
+ chat belongs to chat.bstein.dev.
Start in AUTO routing with a careful, intelligence-biased posture. Every
new request is classified locally before a hosted model is selected. The
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 25b3ada3..15c55b71 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -284,7 +284,7 @@ spec:
- name: HERMES_DASHBOARD
value: "0"
- name: HERMES_DASHBOARD_PUBLIC_URL
- value: https://triage.hermes.bstein.dev
+ value: https://triage.bstein.dev
- name: API_SERVER_ENABLED
value: "true"
- name: API_SERVER_HOST
@@ -292,7 +292,7 @@ spec:
- name: API_SERVER_PORT
value: "8642"
- name: API_SERVER_CORS_ORIGINS
- value: https://triage.hermes.bstein.dev
+ value: https://triage.bstein.dev
- name: VICTORIA_METRICS_URL
value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428
- name: ARIADNE_BASE_URL
@@ -405,7 +405,7 @@ spec:
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
- {name: HERMES_WEBUI_SECURE, value: "1"}
- - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev}
+ - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: triage}
diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml
index 52dea326..5cd9d01f 100644
--- a/services/hermes/oauth2-proxy.yaml
+++ b/services/hermes/oauth2-proxy.yaml
@@ -82,7 +82,7 @@ spec:
args:
- --provider=oidc
- --config=/vault/secrets/oidc-config
- - --redirect-url=https://triage.hermes.bstein.dev/oauth2/callback
+ - --redirect-url=https://triage.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub
- --code-challenge-method=S256
@@ -181,7 +181,7 @@ spec:
args:
- --provider=oidc
- --config=/vault/secrets/oidc-config
- - --redirect-url=https://chat.hermes.bstein.dev/oauth2/callback
+ - --redirect-url=https://chat.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub
- --code-challenge-method=S256
diff --git a/services/hermes/router/telegram.go b/services/hermes/router/telegram.go
index a2d591df..b2dcd799 100644
--- a/services/hermes/router/telegram.go
+++ b/services/hermes/router/telegram.go
@@ -249,7 +249,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
command, args := commandParts(message.Text)
if command == "start" || command == "link" {
if len(args) == 0 {
- _ = bot.sendText(message.Chat.ID, "Sign in to chat.hermes.bstein.dev, open Telegram, and create a one-time link code.")
+ _ = bot.sendText(message.Chat.ID, "Sign in to chat.bstein.dev, open Telegram, and create a one-time link code.")
return
}
if _, err := bot.router.consumeLink(userID, args[0]); err != nil {
@@ -273,7 +273,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
}
slot, linked := bot.router.telegramSlot(userID)
if !linked {
- _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.hermes.bstein.dev and open Telegram to connect it.")
+ _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.bstein.dev and open Telegram to connect it.")
return
}
if command == "topic" {
diff --git a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md
index 9ec70a10..17636d75 100644
--- a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md
+++ b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md
@@ -7,9 +7,9 @@ asserting health, placement, ownership, or current model availability.
| Surface | Purpose | Identity boundary | State and permissions |
| --- | --- | --- | --- |
-| `triage.hermes.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
+| `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
| `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
-| `chat.hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
+| `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
The instances do not share conversation state, credentials, profiles, skills
created on their PVCs, or Kubernetes identities. They share only the inference
diff --git a/services/keycloak/scripts/hermes_access_oidc_ensure.sh b/services/keycloak/scripts/hermes_access_oidc_ensure.sh
index 0ab9fbb0..7fcc4569 100755
--- a/services/keycloak/scripts/hermes_access_oidc_ensure.sh
+++ b/services/keycloak/scripts/hermes_access_oidc_ensure.sh
@@ -327,8 +327,8 @@ ensure_telegram_config() {
}
ensure_hermes_owner
-ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc"
+ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc"
ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
-ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc"
+ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc"
ensure_service_account_client "hermes-automation" "hermes/developer-keycloak"
ensure_telegram_config
diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index d58b342d..c456464b 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -555,7 +555,7 @@ spec:
# open the run that wrote it rather than taking "Proposed by
# Hermes" on trust.
- name: ARIADNE_HERMES_UI_URL
- value: https://triage.hermes.bstein.dev
+ value: https://triage.bstein.dev
- name: ARIADNE_HERMES_SONAR_ENABLED
value: "true"
- name: ARIADNE_HERMES_SONAR_URL
diff --git a/services/quality/zap-baseline-configmap.yaml b/services/quality/zap-baseline-configmap.yaml
index 06bb82bb..c659edbb 100644
--- a/services/quality/zap-baseline-configmap.yaml
+++ b/services/quality/zap-baseline-configmap.yaml
@@ -27,8 +27,8 @@ data:
https://money.bstein.dev
https://health.bstein.dev
https://agent.hermes.bstein.dev
- https://chat.hermes.bstein.dev
- https://triage.hermes.bstein.dev
+ https://chat.bstein.dev
+ https://triage.bstein.dev
https://cassandra.bstein.dev
https://veles.bstein.dev
https://matrix.live.bstein.dev