Hermes Agent
f4f51323f6
hermes: restore legacy chat/triage hosts alongside the renamed ones
...
PR #34 renamed the public chat/triage hosts in place rather than adding
the new names, so chat.hermes.bstein.dev and triage.hermes.bstein.dev
were dropped from the certificate SANs, the hermes-sites Ingress rules
and the CoreDNS overrides at once. Both legacy hosts now answer 404 with
Traefik's default self-signed certificate, and the renamed hosts cannot
complete a login because the Keycloak clients still carry the old
redirect URIs, so chat and triage are unreachable on every hostname.
Make the rename additive, which is the rollback path the post-merge
runbook asks for when the OIDC step fails:
- put the legacy names back on hermes-sites-tls and on the Ingress,
pointing at the same oauth2-proxy backends
- restore both CoreDNS host overrides for in-cluster resolution
- teach ensure_proxy_client to register an optional legacy origin, so
hermes-chat-proxy and hermes-triage-proxy accept the old and new
redirect URIs, web origins and post-logout origins at the same time
while rootUrl stays on the canonical new host
- bump the immutable ensure Job so Flux reruns the script
Serving both names is deliberate: oauth2-proxy cookies are host-bound,
so redirecting the legacy hosts would silently drop live sessions.
Retiring them stays a separate, explicit change.
Supersedes #36 , which only bumped the Job and would have left the
legacy hosts dark.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:49:09 +00:00
Hermes Agent
79be4d1c71
refactor(hermes): rename chat and triage public hosts
2026-08-21 06:43:19 +00:00
jenkins
bb73efb285
feat(hermes): split chat agent and triage surfaces
2026-08-08 17:59:57 -03:00
jenkins
af4d9db64c
fix(vault-injector): run two replicas so restarts cannot skip injection
...
The webhook is failurePolicy: Ignore, so with one replica any pod created
during an injector restart is admitted without its Vault agent sidecar and
then crash-loops forever on a missing /vault/secrets file, with nothing to
indicate injection was skipped. Hit twice while rolling ariadne.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 22:56:49 -03:00
jenkins
c4b4e8a404
Merge origin/main into layout migration
...
Reconciles the services layout migration with ~991 upstream commits:
- Remote content wins for cassandra/cassandra-auth, monitoring dashboards,
vmalert availability rules, veles, vault auth script, dashboard render
script and tests (request-v4 availability definition)
- Layout paths win for structure: keycloak/bstein-dev-home job dirs use
bootstrap-jobs/validation-jobs; cassandra realm jobs live in
cassandra-auth (removed keycloak duplicates)
- Union: applications CR list gains hermes-chat and cassandra
image-automation
- Fixed post-migration paths in dashboard test module loader and
hermes-access job header
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:26:36 -03:00
jenkins
8f45f47e60
refactor: restructure services layout, retire oceanus, add aether scaffolding
...
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
jenkins
cfe70c8f5b
fix(hermes): stabilize consumer chat transport
2026-08-02 15:25:22 -03:00
jenkins
a155847915
feat(cassandra): add migration Grafana rollup
2026-07-25 00:29:03 -03:00
jenkins
b5dd4f5058
feat(cassandra): add parallel migration infrastructure
2026-07-25 00:20:01 -03:00
jenkins
8c3e472e5f
feat(cassandra): add parallel migration infrastructure
2026-07-25 00:18:48 -03:00
jenkins
880736b4ff
agent: replace OpenClaw with Hermes
2026-07-21 21:02:44 -03:00
jenkins
4c37dc1a47
Deploy Veles 0.4.1 runtime support
2026-06-27 19:07:16 -03:00
jenkins
8700593aa5
core: preserve Veles artifacts storageclass parameters
2026-06-27 07:48:46 -03:00
jenkins
6ef4ef161e
Add Veles deployment IaC
2026-06-27 07:37:42 -03:00
jenkins
75e2989ba7
core: repair node role reconciler
2026-06-19 15:45:45 -03:00
jenkins
c53b1ce6ee
recovery(ananke): handle longhorn harbor deadlock
2026-06-18 18:02:32 -03:00
jenkins
7d9d937b52
veles: harden app infrastructure contract
2026-06-09 11:59:27 -03:00
jenkins
b3885138c0
longhorn: ensure engine image on oceanus
2026-06-09 02:06:34 -03:00
jenkins
9488580e1f
longhorn: validate oceanus csi registration
2026-06-09 01:57:59 -03:00
jenkins
777f9f9ec5
longhorn: pin toleration jobs off titan-14
2026-06-09 01:55:02 -03:00
jenkins
e80d7e216e
longhorn: ensure csi tolerates oceanus
2026-06-09 01:53:04 -03:00
jenkins
f6e3993307
longhorn: enforce oceanus taint setting
2026-06-09 01:49:16 -03:00
jenkins
ff93f768de
longhorn: run csi driver on oceanus
2026-06-09 01:47:03 -03:00
jenkins
0ef61650b1
longhorn: set veles recurring job names
2026-06-09 00:49:03 -03:00
jenkins
1d20fb35d2
veles: stage atlas infrastructure
2026-06-09 00:46:46 -03:00
jenkins
11d4b2c013
maintenance: stabilize recovered worker nodes
2026-05-22 17:10:01 -03:00
jenkins
16a561e107
scheduling: target hdd storage node exclusions
2026-05-22 14:02:17 -03:00
jenkins
e5d3362299
scheduling: keep apps off longhorn storage nodes
2026-05-22 13:38:29 -03:00
jenkins
7a4218a653
vault-csi: tolerate busy-node probe delays
2026-05-21 15:52:48 -03:00
jenkins
ae52c8e292
game-stream: expose Wolf Moonlight ports
2026-05-21 03:30:40 -03:00
jenkins
5bec30bd30
game-stream: deploy Wolf foundation
2026-05-21 02:07:17 -03:00
jenkins
38a669ef8d
core(nodes): mark rpi4 spillover workers
2026-05-20 18:14:49 -03:00
jenkins
712b97f64b
agent(openclaw): expose oauth protected UI
2026-05-20 17:22:12 -03:00
jenkins
eab8d26409
ops(traefik): keep ingress available during balancing
2026-05-20 05:23:49 -03:00
jenkins
d14a0bfdfe
ops(cert-manager): keep admission webhook available
2026-05-20 04:51:39 -03:00
jenkins
7b155fd0ec
vault: prefer rpi5 for injector
2026-05-20 02:03:35 -03:00
jenkins
0bdb508bd6
openclaw: route testing triage through ariadne
2026-05-19 23:30:29 -03:00
jenkins
845bd99dee
ops: fix descheduler policy for chart api
2026-05-19 18:06:30 -03:00
jenkins
5b6e10a6e3
cert-manager: harden webhook resources
2026-05-19 17:35:10 -03:00
jenkins
e055b83af2
ci(jenkins): reduce default agent cpu request
2026-05-19 16:21:43 -03:00
jenkins
d9809c4026
ops: keep scavenger work out of scheduler headroom
2026-05-19 16:02:10 -03:00
jenkins
281cc058d8
ops: add resource guardrails for rpi workers
2026-05-19 12:48:40 -03:00
jenkins
2c37ee4f84
recovery: keep storage nodes as spillover only
2026-05-15 11:52:26 -03:00
jenkins
e55839d499
postgres: avoid unstable nodes
2026-05-10 04:04:34 -03:00
jenkins
68089c48f0
scheduling: keep longhorn vault sync off storage nodes
2026-05-05 13:46:19 -03:00
jenkins
9a38073a03
scheduling: keep singleton apps off storage nodes
2026-05-05 13:37:04 -03:00
jenkins
434ecaea6a
recovery(atlas): stop post-outage control-plane churn
2026-05-05 10:42:28 -03:00
d773295ace
longhorn: rerun settings ensure job
2026-04-27 16:16:51 -03:00
e6d2649bbc
stability: harden fluent-bit buffering and longhorn node-down recovery
2026-04-27 16:15:13 -03:00
jenkins
3ab94dcd91
longhorn: bound settings sync curl calls and rerun job
2026-04-21 21:18:41 -03:00
