titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity
5,567 Commits 81 Branches 0 Tags
Commit Graph

197 Commits

Author SHA1 Message Date
Hermes Agent
f4f51323f6 hermes: restore legacy chat/triage hosts alongside the renamed ones 
PR #34 renamed the public chat/triage hosts in place rather than adding
the new names, so chat.hermes.bstein.dev and triage.hermes.bstein.dev
were dropped from the certificate SANs, the hermes-sites Ingress rules
and the CoreDNS overrides at once. Both legacy hosts now answer 404 with
Traefik's default self-signed certificate, and the renamed hosts cannot
complete a login because the Keycloak clients still carry the old
redirect URIs, so chat and triage are unreachable on every hostname.

Make the rename additive, which is the rollback path the post-merge
runbook asks for when the OIDC step fails:

- put the legacy names back on hermes-sites-tls and on the Ingress,
  pointing at the same oauth2-proxy backends
- restore both CoreDNS host overrides for in-cluster resolution
- teach ensure_proxy_client to register an optional legacy origin, so
  hermes-chat-proxy and hermes-triage-proxy accept the old and new
  redirect URIs, web origins and post-logout origins at the same time
  while rootUrl stays on the canonical new host
- bump the immutable ensure Job so Flux reruns the script

Serving both names is deliberate: oauth2-proxy cookies are host-bound,
so redirecting the legacy hosts would silently drop live sessions.
Retiring them stays a separate, explicit change.

Supersedes #36, which only bumped the Job and would have left the
legacy hosts dark.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-21 08:49:09 +00:00
Hermes Agent
79be4d1c71 refactor(hermes): rename chat and triage public hosts 2026-08-21 06:43:19 +00:00
jenkins
f81557e1c2 keycloak: fit Hermes bootstrap on Pi workers 2026-08-13 18:07:22 -03:00
jenkins
2a3e8cf064 keycloak: prefer healthy workers for Hermes bootstrap 2026-08-13 18:03:08 -03:00
jenkins
c5b3dee08f keycloak: retry Hermes automation bootstrap 2026-08-13 17:55:58 -03:00
jenkins
d4776556b4 keycloak: add Hermes automation identity 2026-08-13 17:45:09 -03:00
jenkins
c817f3cef7 hermes(agent): replace HERDR with native CLI lanes 2026-08-10 16:31:06 -03:00
jenkins
bb73efb285 feat(hermes): split chat agent and triage surfaces 2026-08-08 17:59:57 -03:00
jenkins
c4b4e8a404 Merge origin/main into layout migration 
Reconciles the services layout migration with ~991 upstream commits:
- Remote content wins for cassandra/cassandra-auth, monitoring dashboards,
  vmalert availability rules, veles, vault auth script, dashboard render
  script and tests (request-v4 availability definition)
- Layout paths win for structure: keycloak/bstein-dev-home job dirs use
  bootstrap-jobs/validation-jobs; cassandra realm jobs live in
  cassandra-auth (removed keycloak duplicates)
- Union: applications CR list gains hermes-chat and cassandra
  image-automation
- Fixed post-migration paths in dashboard test module loader and
  hermes-access job header

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-05 16:26:36 -03:00
jenkins
8f45f47e60 refactor: restructure services layout, retire oceanus, add aether scaffolding 
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
  repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-05 16:21:36 -03:00
jenkins
cfe70c8f5b fix(hermes): stabilize consumer chat transport 2026-08-02 15:25:22 -03:00
jenkins
c4320b9718 ai(hermes): avoid unstable titan-18 placement 2026-08-02 02:35:39 -03:00
jenkins
5f4bdc6e7e ai(hermes): add isolated user chat instance 2026-08-02 02:31:01 -03:00
jenkins
880736b4ff agent: replace OpenClaw with Hermes 2026-07-21 21:02:44 -03:00
jenkins
6d200d79ae maintenance: expire completed one-off jobs 2026-07-14 17:10:18 -03:00
jenkins
2925c252d2 Fix Veles Keycloak mapper update 2026-06-28 18:39:10 -03:00
jenkins
9e89608df9 Roll Veles Keycloak ensure job 2026-06-28 18:14:45 -03:00
jenkins
163d99078b Deploy Veles 0.4.5 public feedback 2026-06-28 17:33:33 -03:00
jenkins
6ef4ef161e Add Veles deployment IaC 2026-06-27 07:37:42 -03:00
jenkins
4a9ac01273 gitea: constrain Veles tester feedback access 2026-06-20 15:12:51 -03:00
jenkins
b6fc9dfe54 keycloak: allow groups scope for Veles Gitea 2026-06-20 14:50:16 -03:00
jenkins
db7ecfb16d keycloak: clear Gitea Veles OIDC PKCE flag 2026-06-20 14:23:46 -03:00
jenkins
6dd6356433 keycloak: disable PKCE for Gitea Veles OIDC 2026-06-20 14:20:15 -03:00
jenkins
74ab9bc78b gitea: wire Veles OIDC login 2026-06-20 14:08:18 -03:00
jenkins
bb2f9d1603 Disable runtime Keycloak Mailu provider loading 2026-06-12 03:05:54 -03:00
jenkins
bb2a90b67c Raise Keycloak memory for provider augmentation 2026-06-12 02:54:54 -03:00
jenkins
419ce55f17 Give Keycloak provider augmentation more startup grace 2026-06-12 02:43:03 -03:00
jenkins
42761b16fb Stop copying Keycloak provider sources at runtime 2026-06-12 02:31:39 -03:00
jenkins
e445a29970 Revert Keycloak image bump 2026-06-12 02:23:07 -03:00
jenkins
537b079062 Bump Keycloak for Veles registration flow 2026-06-12 02:02:02 -03:00
jenkins
7e7e3c23e9 Roll Veles auth-scoped app images 2026-06-09 18:00:57 -03:00
jenkins
7d9d937b52 veles: harden app infrastructure contract 2026-06-09 11:59:27 -03:00
jenkins
c3c5978cfa keycloak: make veles realm job idempotent 2026-06-09 01:26:22 -03:00
jenkins
1a7049b612 keycloak: fix veles groups mapper 2026-06-09 01:18:30 -03:00
jenkins
1d20fb35d2 veles: stage atlas infrastructure 2026-06-09 00:46:46 -03:00
jenkins
2e49e97783 keycloak(portal): allow groups scope 2026-05-22 02:48:10 -03:00
jenkins
35f1a821f8 sso(keycloak): suspend portal admin role ensure 2026-05-21 03:22:44 -03:00
jenkins
f795488784 sso(keycloak): grant portal admin client management 2026-05-21 02:43:19 -03:00
jenkins
712b97f64b agent(openclaw): expose oauth protected UI 2026-05-20 17:22:12 -03:00
jenkins
2c37ee4f84 recovery: keep storage nodes as spillover only 2026-05-15 11:52:26 -03:00
Codex
e861b03231 keycloak(metis): seed node intranet ips in vault 2026-04-24 22:18:58 -03:00
jenkins
c105d03ec2 recovery(metis): trim node vault password placeholders 2026-04-24 18:07:35 -03:00
jenkins
17993a0e5c recovery(metis): rerun node password seeding job 2026-04-24 17:33:40 -03:00
jenkins
1917ec3e1d recovery(metis): use atlas kv node secrets 2026-04-24 17:29:58 -03:00
jenkins
5b150958a4 recovery(metis): seed per-node vault password slots 2026-04-24 17:24:37 -03:00
jenkins
42b86f3b82 maintenance(metis): move ingress to recovery host 2026-04-24 10:51:09 -03:00
Brad Stein
45fde5e2bc quality: standardize suite checks and add SonarQube stack 2026-04-19 14:18:58 -03:00
Brad Stein
518aa305f4 maintenance(soteria): add protected UI, OIDC bootstrap, and backup health panel wiring 2026-04-12 15:07:53 -03:00
Brad Stein
9a07aa9be9 keycloak: make metis ssh db key optional during migration 2026-04-07 04:40:56 -03:00
Brad Stein
a4631dee81 maintenance: migrate metis ssh key names to ananke 2026-04-07 04:36:42 -03:00