WIP: Rename the owner agent host to worker.bstein.dev (merge last) #41

Closed

hermes-automation wants to merge 2 commits from feature/hermes-domain-rename-agent-worker-bstein into main

Author	SHA1	Message	Date
Hermes Agent	92ec0c0297	refactor(hermes): rename the owner agent host to worker.bstein.dev Introduce worker.bstein.dev as the canonical hostname for the owner-only Hermes coordinator, previously agent.hermes.bstein.dev. The old host is deliberately kept alive. CoreDNS, both agent Ingresses and the hermes-sites certificate now serve BOTH names, so merging this cannot take away the endpoint the operator uses to reach the coordinator. Retiring agent.hermes.bstein.dev is a separate, separately scheduled change. No redirect middleware is added. What switches to the new host: - HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url - the Keycloak hermes-agent-proxy rootUrl - operator docs, skills, the ZAP baseline target and the triage monitor default What stays dual-homed until retirement: - CoreDNS hosts entry, both agent Ingress rules, certificate SANs - API_SERVER_CORS_ORIGINS (now a comma-separated pair) - the Keycloak redirect URIs, web origins and post-logout origins, so a rollback only needs the oauth2-proxy --redirect-url reverted and does not require re-running the ensure job ensure_proxy_client now takes optional trailing legacy URLs; called with a single URL it emits the identical payload as before, so the chat and triage clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it; login on the new host fails until that Job completes. Because the session and CSRF cookies use the __Host- prefix they are bound to one origin, so a fresh login must start on worker.bstein.dev and existing sessions do not carry over -- re-login is required after rollout. Knowledge catalogs and diagrams regenerated with `make knowledge`.	2026-08-21 10:13:33 +00:00
Hermes Agent	26705c1f66	chore(knowledge): regenerate stale Atlas catalogs `make knowledge` output on main no longer matched the manifests it is rendered from: Flux kustomizations added since the last regeneration (hermes-scm-broker, hermes-scm-broker-code, hermes-scm-namespace, hermes-observer-rbac, hermes-observer-bindings, vault-hermes-jenkins-token-seed) and the Atlas AI Operations dashboard panels were missing from the committed artifacts. This is a pure `make knowledge` run against unmodified main, separated into its own commit so the hostname rename that follows reviews as a hostname rename and nothing else. No hand edits.	2026-08-21 09:58:42 +00:00

Author

SHA1

Message

Date

Hermes Agent

92ec0c0297

refactor(hermes): rename the owner agent host to worker.bstein.dev

Introduce worker.bstein.dev as the canonical hostname for the owner-only
Hermes coordinator, previously agent.hermes.bstein.dev.

The old host is deliberately kept alive. CoreDNS, both agent Ingresses and
the hermes-sites certificate now serve BOTH names, so merging this cannot
take away the endpoint the operator uses to reach the coordinator. Retiring
agent.hermes.bstein.dev is a separate, separately scheduled change. No
redirect middleware is added.

What switches to the new host:
- HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url
- the Keycloak hermes-agent-proxy rootUrl
- operator docs, skills, the ZAP baseline target and the triage monitor default

What stays dual-homed until retirement:
- CoreDNS hosts entry, both agent Ingress rules, certificate SANs
- API_SERVER_CORS_ORIGINS (now a comma-separated pair)
- the Keycloak redirect URIs, web origins and post-logout origins, so a
  rollback only needs the oauth2-proxy --redirect-url reverted and does not
  require re-running the ensure job

ensure_proxy_client now takes optional trailing legacy URLs; called with a
single URL it emits the identical payload as before, so the chat and triage
clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it;
login on the new host fails until that Job completes.

Because the session and CSRF cookies use the __Host- prefix they are bound to
one origin, so a fresh login must start on worker.bstein.dev and existing
sessions do not carry over -- re-login is required after rollout.

Knowledge catalogs and diagrams regenerated with `make knowledge`.

2026-08-21 10:13:33 +00:00

Hermes Agent

26705c1f66

chore(knowledge): regenerate stale Atlas catalogs

`make knowledge` output on main no longer matched the manifests it is
rendered from: Flux kustomizations added since the last regeneration
(hermes-scm-broker, hermes-scm-broker-code, hermes-scm-namespace,
hermes-observer-rbac, hermes-observer-bindings,
vault-hermes-jenkins-token-seed) and the Atlas AI Operations dashboard
panels were missing from the committed artifacts.

This is a pure `make knowledge` run against unmodified main, separated
into its own commit so the hostname rename that follows reviews as a
hostname rename and nothing else. No hand edits.

2026-08-21 09:58:42 +00:00

WIP: Rename the owner agent host to worker.bstein.dev (merge last) #41

2 Commits