Introduce worker.bstein.dev as the canonical hostname for the owner-only
Hermes coordinator, previously agent.hermes.bstein.dev.
The old host is deliberately kept alive. CoreDNS, both agent Ingresses and
the hermes-sites certificate now serve BOTH names, so merging this cannot
take away the endpoint the operator uses to reach the coordinator. Retiring
agent.hermes.bstein.dev is a separate, separately scheduled change. No
redirect middleware is added.
What switches to the new host:
- HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url
- the Keycloak hermes-agent-proxy rootUrl
- operator docs, skills, the ZAP baseline target and the triage monitor default
What stays dual-homed until retirement:
- CoreDNS hosts entry, both agent Ingress rules, certificate SANs
- API_SERVER_CORS_ORIGINS (now a comma-separated pair)
- the Keycloak redirect URIs, web origins and post-logout origins, so a
rollback only needs the oauth2-proxy --redirect-url reverted and does not
require re-running the ensure job
ensure_proxy_client now takes optional trailing legacy URLs; called with a
single URL it emits the identical payload as before, so the chat and triage
clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it;
login on the new host fails until that Job completes.
Because the session and CSRF cookies use the __Host- prefix they are bound to
one origin, so a fresh login must start on worker.bstein.dev and existing
sessions do not carry over -- re-login is required after rollout.
Knowledge catalogs and diagrams regenerated with `make knowledge`.
START-HERE.md is visible in the Hermes dashboard, so its wording is part of
what an operator sees. Describing the runbook as a five-minute demonstration
frames the automation as a set piece rather than as something that runs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Codex weekly limit is close, so make anthropic/claude-opus-5 primary and
demote openai-codex to first fallback with the local gpt-oss:20b behind it.
The credential is a Claude subscription OAuth token, not an API key. The
anthropic provider resolves ANTHROPIC_API_KEY, then ANTHROPIC_TOKEN, then
CLAUDE_CODE_OAUTH_TOKEN, so the OAuth token must arrive under the last name
to be treated correctly. Marked optional so Hermes still starts and falls
back if the Secret is absent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
