Hermes Agent
92ec0c0297
refactor(hermes): rename the owner agent host to worker.bstein.dev
...
Introduce worker.bstein.dev as the canonical hostname for the owner-only
Hermes coordinator, previously agent.hermes.bstein.dev.
The old host is deliberately kept alive. CoreDNS, both agent Ingresses and
the hermes-sites certificate now serve BOTH names, so merging this cannot
take away the endpoint the operator uses to reach the coordinator. Retiring
agent.hermes.bstein.dev is a separate, separately scheduled change. No
redirect middleware is added.
What switches to the new host:
- HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url
- the Keycloak hermes-agent-proxy rootUrl
- operator docs, skills, the ZAP baseline target and the triage monitor default
What stays dual-homed until retirement:
- CoreDNS hosts entry, both agent Ingress rules, certificate SANs
- API_SERVER_CORS_ORIGINS (now a comma-separated pair)
- the Keycloak redirect URIs, web origins and post-logout origins, so a
rollback only needs the oauth2-proxy --redirect-url reverted and does not
require re-running the ensure job
ensure_proxy_client now takes optional trailing legacy URLs; called with a
single URL it emits the identical payload as before, so the chat and triage
clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it;
login on the new host fails until that Job completes.
Because the session and CSRF cookies use the __Host- prefix they are bound to
one origin, so a fresh login must start on worker.bstein.dev and existing
sessions do not carry over -- re-login is required after rollout.
Knowledge catalogs and diagrams regenerated with `make knowledge`.
2026-08-21 10:13:33 +00:00
Hermes Agent
79be4d1c71
refactor(hermes): rename chat and triage public hosts
2026-08-21 06:43:19 +00:00
jenkins
f81557e1c2
keycloak: fit Hermes bootstrap on Pi workers
2026-08-13 18:07:22 -03:00
jenkins
2a3e8cf064
keycloak: prefer healthy workers for Hermes bootstrap
2026-08-13 18:03:08 -03:00
jenkins
c5b3dee08f
keycloak: retry Hermes automation bootstrap
2026-08-13 17:55:58 -03:00
jenkins
d4776556b4
keycloak: add Hermes automation identity
2026-08-13 17:45:09 -03:00
jenkins
c817f3cef7
hermes(agent): replace HERDR with native CLI lanes
2026-08-10 16:31:06 -03:00
jenkins
bb73efb285
feat(hermes): split chat agent and triage surfaces
2026-08-08 17:59:57 -03:00
jenkins
c4b4e8a404
Merge origin/main into layout migration
...
Reconciles the services layout migration with ~991 upstream commits:
- Remote content wins for cassandra/cassandra-auth, monitoring dashboards,
vmalert availability rules, veles, vault auth script, dashboard render
script and tests (request-v4 availability definition)
- Layout paths win for structure: keycloak/bstein-dev-home job dirs use
bootstrap-jobs/validation-jobs; cassandra realm jobs live in
cassandra-auth (removed keycloak duplicates)
- Union: applications CR list gains hermes-chat and cassandra
image-automation
- Fixed post-migration paths in dashboard test module loader and
hermes-access job header
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:26:36 -03:00
jenkins
8f45f47e60
refactor: restructure services layout, retire oceanus, add aether scaffolding
...
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
jenkins
cfe70c8f5b
fix(hermes): stabilize consumer chat transport
2026-08-02 15:25:22 -03:00
jenkins
c4320b9718
ai(hermes): avoid unstable titan-18 placement
2026-08-02 02:35:39 -03:00
jenkins
5f4bdc6e7e
ai(hermes): add isolated user chat instance
2026-08-02 02:31:01 -03:00
jenkins
880736b4ff
agent: replace OpenClaw with Hermes
2026-07-21 21:02:44 -03:00
jenkins
6d200d79ae
maintenance: expire completed one-off jobs
2026-07-14 17:10:18 -03:00
jenkins
2925c252d2
Fix Veles Keycloak mapper update
2026-06-28 18:39:10 -03:00
jenkins
9e89608df9
Roll Veles Keycloak ensure job
2026-06-28 18:14:45 -03:00
jenkins
163d99078b
Deploy Veles 0.4.5 public feedback
2026-06-28 17:33:33 -03:00
jenkins
6ef4ef161e
Add Veles deployment IaC
2026-06-27 07:37:42 -03:00
jenkins
4a9ac01273
gitea: constrain Veles tester feedback access
2026-06-20 15:12:51 -03:00
jenkins
b6fc9dfe54
keycloak: allow groups scope for Veles Gitea
2026-06-20 14:50:16 -03:00
jenkins
db7ecfb16d
keycloak: clear Gitea Veles OIDC PKCE flag
2026-06-20 14:23:46 -03:00
jenkins
6dd6356433
keycloak: disable PKCE for Gitea Veles OIDC
2026-06-20 14:20:15 -03:00
jenkins
74ab9bc78b
gitea: wire Veles OIDC login
2026-06-20 14:08:18 -03:00
jenkins
bb2f9d1603
Disable runtime Keycloak Mailu provider loading
2026-06-12 03:05:54 -03:00
jenkins
bb2a90b67c
Raise Keycloak memory for provider augmentation
2026-06-12 02:54:54 -03:00
jenkins
419ce55f17
Give Keycloak provider augmentation more startup grace
2026-06-12 02:43:03 -03:00
jenkins
42761b16fb
Stop copying Keycloak provider sources at runtime
2026-06-12 02:31:39 -03:00
jenkins
e445a29970
Revert Keycloak image bump
2026-06-12 02:23:07 -03:00
jenkins
537b079062
Bump Keycloak for Veles registration flow
2026-06-12 02:02:02 -03:00
jenkins
7e7e3c23e9
Roll Veles auth-scoped app images
2026-06-09 18:00:57 -03:00
jenkins
7d9d937b52
veles: harden app infrastructure contract
2026-06-09 11:59:27 -03:00
jenkins
c3c5978cfa
keycloak: make veles realm job idempotent
2026-06-09 01:26:22 -03:00
jenkins
1a7049b612
keycloak: fix veles groups mapper
2026-06-09 01:18:30 -03:00
jenkins
1d20fb35d2
veles: stage atlas infrastructure
2026-06-09 00:46:46 -03:00
jenkins
2e49e97783
keycloak(portal): allow groups scope
2026-05-22 02:48:10 -03:00
jenkins
35f1a821f8
sso(keycloak): suspend portal admin role ensure
2026-05-21 03:22:44 -03:00
jenkins
f795488784
sso(keycloak): grant portal admin client management
2026-05-21 02:43:19 -03:00
jenkins
712b97f64b
agent(openclaw): expose oauth protected UI
2026-05-20 17:22:12 -03:00
jenkins
2c37ee4f84
recovery: keep storage nodes as spillover only
2026-05-15 11:52:26 -03:00
Codex
e861b03231
keycloak(metis): seed node intranet ips in vault
2026-04-24 22:18:58 -03:00
jenkins
c105d03ec2
recovery(metis): trim node vault password placeholders
2026-04-24 18:07:35 -03:00
jenkins
17993a0e5c
recovery(metis): rerun node password seeding job
2026-04-24 17:33:40 -03:00
jenkins
1917ec3e1d
recovery(metis): use atlas kv node secrets
2026-04-24 17:29:58 -03:00
jenkins
5b150958a4
recovery(metis): seed per-node vault password slots
2026-04-24 17:24:37 -03:00
jenkins
42b86f3b82
maintenance(metis): move ingress to recovery host
2026-04-24 10:51:09 -03:00
45fde5e2bc
quality: standardize suite checks and add SonarQube stack
2026-04-19 14:18:58 -03:00
518aa305f4
maintenance(soteria): add protected UI, OIDC bootstrap, and backup health panel wiring
2026-04-12 15:07:53 -03:00
9a07aa9be9
keycloak: make metis ssh db key optional during migration
2026-04-07 04:40:56 -03:00
a4631dee81
maintenance: migrate metis ssh key names to ananke
2026-04-07 04:36:42 -03:00
