538 lines
24 KiB
YAML
538 lines
24 KiB
YAML
# services/hermes/agent-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hermes-agent
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-agent
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 2
|
|
progressDeadlineSeconds: 2700
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: hermes-agent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: hermes-agent
|
|
annotations:
|
|
ai.bstein.dev/role: project-coordinator
|
|
ai.bstein.dev/execution: Herdr-supervised Codex and Claude Code
|
|
ai.bstein.dev/model-policy: difficulty-aware low through xhigh, cross-provider fallback
|
|
ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
|
|
ai.bstein.dev/config-rev: "20260809-herdr-hermes-integration"
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/role: hermes-agent
|
|
vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
|
|
vault.hashicorp.com/agent-inject-template-anthropic-token: |
|
|
{{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
|
|
{{ .Data.data.anthropic_oauth_token }}
|
|
{{- end }}
|
|
vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/agent-tokens
|
|
vault.hashicorp.com/agent-inject-template-gitea-token: |
|
|
{{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
|
|
{{- with index .Data.data "gitea_token" -}}
|
|
{{ . }}
|
|
{{- end -}}
|
|
{{- end }}
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/agent-init-first: "true"
|
|
vault.hashicorp.com/agent-requests-cpu: 25m
|
|
vault.hashicorp.com/agent-requests-mem: 32Mi
|
|
vault.hashicorp.com/agent-limits-cpu: 100m
|
|
vault.hashicorp.com/agent-limits-mem: 128Mi
|
|
spec:
|
|
serviceAccountName: hermes-agent
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
fsGroup: 10000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/arch
|
|
operator: In
|
|
values: [arm64]
|
|
- key: node-role.kubernetes.io/worker
|
|
operator: In
|
|
values: ["true"]
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values: [titan-08, titan-13, titan-14, titan-17, titan-18]
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values: [rpi5]
|
|
initContainers:
|
|
- name: init-config
|
|
image: busybox:1.37
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
env_file=/opt/data/.env
|
|
mkdir -p \
|
|
/opt/data/home/.claude \
|
|
/opt/data/home/.codex \
|
|
/opt/data/home/.config/herdr \
|
|
/opt/data/herdr \
|
|
/opt/data/logs \
|
|
/opt/data/tools/bin \
|
|
/opt/data/workspace/coordinator \
|
|
/opt/data/workspace/projects \
|
|
/opt/data/workspace/skills
|
|
if [ ! -e /opt/data/home/.hermes ]; then
|
|
ln -s /opt/data /opt/data/home/.hermes
|
|
fi
|
|
cp /config/config.yaml /opt/data/config.yaml
|
|
cp /config/SOUL.md /opt/data/SOUL.md
|
|
cp /config/AGENTS.md /opt/data/workspace/AGENTS.md
|
|
cp /config/START-HERE.md /opt/data/workspace/START-HERE.md
|
|
touch "${env_file}"
|
|
upsert_env() {
|
|
key="$1"
|
|
value="$2"
|
|
{ grep -v "^${key}=" "${env_file}" || true; printf '%s=%s\n' "${key}" "${value}"; } > "${env_file}.tmp"
|
|
mv "${env_file}.tmp" "${env_file}"
|
|
}
|
|
if ! grep -q '^API_SERVER_KEY=' "${env_file}"; then
|
|
api_key="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
|
|
upsert_env API_SERVER_KEY "${api_key}"
|
|
fi
|
|
if [ -s /vault/secrets/anthropic-token ]; then
|
|
token="$(tr -d '\r\n' < /vault/secrets/anthropic-token)"
|
|
[ -z "${token}" ] || upsert_env CLAUDE_CODE_OAUTH_TOKEN "${token}"
|
|
fi
|
|
if [ -s /vault/secrets/gitea-token ]; then
|
|
token="$(tr -d '\r\n' < /vault/secrets/gitea-token)"
|
|
case "${token}" in ""|"<no value>"|"<nil>") ;; *) upsert_env GITEA_TOKEN "${token}" ;; esac
|
|
fi
|
|
upsert_env GITEA_USERNAME bstein
|
|
upsert_env GIT_ASKPASS /opt/coordinator/gitea_askpass.sh
|
|
upsert_env GIT_TERMINAL_PROMPT 0
|
|
chmod 0600 "${env_file}"
|
|
chown -R 10000:10000 /opt/data
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /opt/data
|
|
- name: config
|
|
mountPath: /config
|
|
readOnly: true
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: 100m, memory: 64Mi}
|
|
- name: install-agent-tools
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
tools=/opt/data/tools
|
|
mkdir -p "${tools}/bin"
|
|
herdr_version="$("${tools}/bin/herdr" --version 2>/dev/null || true)"
|
|
case "${herdr_version}" in *0.8.0*) herdr_ready=1 ;; *) herdr_ready=0 ;; esac
|
|
if [ "${herdr_ready}" != "1" ]; then
|
|
curl -fsSL -o "${tools}/bin/herdr.tmp" https://github.com/herdrdev/herdr/releases/download/v0.8.0/herdr-linux-aarch64
|
|
printf '%s %s\n' f647ac66468d9efbc642fe534fb284468f0aea60641606fc008dfc0d82a3ca87 "${tools}/bin/herdr.tmp" | sha256sum -c -
|
|
chmod 0755 "${tools}/bin/herdr.tmp"
|
|
mv "${tools}/bin/herdr.tmp" "${tools}/bin/herdr"
|
|
fi
|
|
ttyd_version="$("${tools}/bin/ttyd" --version 2>/dev/null || true)"
|
|
case "${ttyd_version}" in *1.7.7*) ttyd_ready=1 ;; *) ttyd_ready=0 ;; esac
|
|
if [ "${ttyd_ready}" != "1" ]; then
|
|
curl -fsSL -o "${tools}/bin/ttyd.tmp" https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.aarch64
|
|
printf '%s %s\n' b38acadd89d1d396a0f5649aa52c539edbad07f4bc7348b27b4f4b7219dd4165 "${tools}/bin/ttyd.tmp" | sha256sum -c -
|
|
chmod 0755 "${tools}/bin/ttyd.tmp"
|
|
mv "${tools}/bin/ttyd.tmp" "${tools}/bin/ttyd"
|
|
fi
|
|
if [ ! -f "${tools}/.cli-versions-0.147.0-2.1.226" ]; then
|
|
npm install --global --omit=dev --no-audit --no-fund --prefix "${tools}" \
|
|
@openai/codex@0.147.0 \
|
|
@anthropic-ai/claude-code@2.1.226
|
|
touch "${tools}/.cli-versions-0.147.0-2.1.226"
|
|
fi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- name: home
|
|
mountPath: /opt/data
|
|
resources:
|
|
requests: {cpu: 100m, memory: 256Mi}
|
|
limits: {cpu: "1", memory: 1Gi}
|
|
- name: patch-auth
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /opt/hermes/.venv/bin/python
|
|
- /opt/coordinator/patch_hermes_auth.py
|
|
- /opt/hermes/hermes_cli/auth.py
|
|
- /patched/auth.py
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- name: coordinator
|
|
mountPath: /opt/coordinator
|
|
readOnly: true
|
|
- name: auth-patch
|
|
mountPath: /patched
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: 100m, memory: 128Mi}
|
|
- name: bootstrap-coordinator
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /opt/hermes/.venv/bin/python
|
|
- /opt/coordinator/hermes_coordinator.py
|
|
- --once
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: PYTHONPATH, value: /opt/hermes}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: provider-auth, mountPath: /shared-auth}
|
|
- {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
|
|
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: 500m, memory: 512Mi}
|
|
- name: install-herdr-integrations
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- |
|
|
herdr integration install codex
|
|
herdr integration install claude
|
|
herdr integration install hermes
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: CODEX_HOME, value: /opt/data/home/.codex}
|
|
- {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
|
|
- {name: PATH, value: /opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
containers:
|
|
- name: hermes
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/opt/hermes/.venv/bin/hermes]
|
|
args: [gateway, run, --no-supervise]
|
|
ports:
|
|
- {name: api, containerPort: 8642, protocol: TCP}
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: CODEX_HOME, value: /opt/data/home/.codex}
|
|
- {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
|
|
- {name: HERDR_CONFIG_PATH, value: /opt/data/home/.config/herdr/config.toml}
|
|
- {name: HERDR_SOCKET_PATH, value: /opt/data/herdr/herdr.sock}
|
|
- {name: PATH, value: /opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}
|
|
- {name: HERMES_DASHBOARD, value: "0"}
|
|
- {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://agent.hermes.bstein.dev}
|
|
- {name: API_SERVER_ENABLED, value: "true"}
|
|
- {name: API_SERVER_HOST, value: 0.0.0.0}
|
|
- {name: API_SERVER_PORT, value: "8642"}
|
|
- {name: API_SERVER_CORS_ORIGINS, value: https://agent.hermes.bstein.dev}
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: provider-auth, mountPath: /shared-auth}
|
|
- {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
|
|
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
|
- {name: coordinator, mountPath: /opt/data/home/.local/bin/herdr-dispatch, subPath: herdr_dispatch.py, readOnly: true}
|
|
startupProbe:
|
|
tcpSocket: {port: api}
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 60
|
|
readinessProbe:
|
|
tcpSocket: {port: api}
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
tcpSocket: {port: api}
|
|
initialDelaySeconds: 90
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests: {cpu: 250m, memory: 512Mi}
|
|
limits: {cpu: "2", memory: 4Gi}
|
|
- name: webui
|
|
image: registry.bstein.dev/bstein/hermes-webui@sha256:a771858bd668d25e19c74864baea5425101c8cd5215d1ba3a312f3312ce6c5e1
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
api_key="$(sed -n 's/^API_SERVER_KEY=//p' /opt/data/.env | tail -n 1)"
|
|
test -n "${api_key}"
|
|
export API_SERVER_KEY="${api_key}"
|
|
export HERMES_WEBUI_GATEWAY_API_KEY="${api_key}"
|
|
exec /opt/hermes/.venv/bin/python /opt/hermes-webui/server.py
|
|
ports:
|
|
- {name: dashboard, containerPort: 8787, protocol: TCP}
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: HERMES_WEBUI_AGENT_DIR, value: /opt/hermes}
|
|
- {name: HERMES_WEBUI_HOST, value: 0.0.0.0}
|
|
- {name: HERMES_WEBUI_PORT, value: "8787"}
|
|
- {name: HERMES_WEBUI_STATE_DIR, value: /opt/data/webui}
|
|
- {name: HERMES_WEBUI_DEFAULT_WORKSPACE, value: /opt/data/workspace}
|
|
- {name: HERMES_WEBUI_CHAT_BACKEND, value: gateway}
|
|
- {name: HERMES_WEBUI_GATEWAY_BASE_URL, value: http://127.0.0.1:8642}
|
|
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
|
|
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
|
|
- {name: HERMES_WEBUI_SECURE, value: "1"}
|
|
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://agent.hermes.bstein.dev}
|
|
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
|
|
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: provider-auth, mountPath: /shared-auth, readOnly: true}
|
|
- {name: tmp, mountPath: /tmp}
|
|
readinessProbe:
|
|
httpGet: {path: /health, port: dashboard}
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /health, port: dashboard}
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: 750m, memory: 1Gi}
|
|
- name: herdr-tui
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
set -a
|
|
. /opt/data/.env
|
|
set +a
|
|
exec /opt/data/tools/bin/ttyd \
|
|
--writable \
|
|
--check-origin \
|
|
--interface 0.0.0.0 \
|
|
--port 7681 \
|
|
--cwd /opt/data/workspace \
|
|
--terminal-type xterm-256color \
|
|
--client-option "titleFixed=Hermes Agent - HERDR" \
|
|
--client-option fontSize=15 \
|
|
/opt/data/tools/bin/herdr
|
|
ports:
|
|
- {name: herdr-tui, containerPort: 7681, protocol: TCP}
|
|
env:
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: CODEX_HOME, value: /opt/data/home/.codex}
|
|
- {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
|
|
- {name: HERDR_CONFIG_PATH, value: /opt/data/home/.config/herdr/config.toml}
|
|
- {name: HERDR_SOCKET_PATH, value: /opt/data/herdr/herdr.sock}
|
|
- {name: PATH, value: /opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: tmp, mountPath: /tmp}
|
|
startupProbe:
|
|
tcpSocket: {port: herdr-tui}
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 60
|
|
readinessProbe:
|
|
tcpSocket: {port: herdr-tui}
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
livenessProbe:
|
|
tcpSocket: {port: herdr-tui}
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: 500m, memory: 512Mi}
|
|
- name: herdr-server
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
set -a
|
|
. /opt/data/.env
|
|
set +a
|
|
herdr server &
|
|
server_pid=$!
|
|
trap 'kill "${server_pid}" 2>/dev/null || true' TERM INT
|
|
for attempt in $(seq 1 60); do
|
|
if herdr status server >/dev/null 2>&1; then break; fi
|
|
sleep 1
|
|
done
|
|
pane_file=/opt/data/herdr/coordinator-pane-id
|
|
pane="$(cat "${pane_file}" 2>/dev/null || true)"
|
|
if [ -z "${pane}" ] || ! herdr pane get "${pane}" >/dev/null 2>&1; then
|
|
created="$(herdr workspace create \
|
|
--cwd /opt/data/workspace \
|
|
--label coordinator \
|
|
--env HERMES_HOME=/opt/data \
|
|
--env HERMES_AUTH_FILE=/shared-auth/auth.json \
|
|
--env HOME=/opt/data/home \
|
|
--env PYTHONPATH=/opt/hermes \
|
|
--focus)"
|
|
pane="$(printf '%s' "${created}" | /opt/hermes/.venv/bin/python -c \
|
|
'import json,sys; print(json.load(sys.stdin)["result"]["root_pane"]["pane_id"])')"
|
|
printf '%s\n' "${pane}" > "${pane_file}"
|
|
fi
|
|
process_info="$(herdr pane process-info --pane "${pane}" 2>/dev/null || printf '%s\n' '{"result":{"process_info":{"foreground_processes":[]}}}')"
|
|
coordinator_running="$(printf '%s' "${process_info}" | /opt/hermes/.venv/bin/python -c \
|
|
'import json,sys; processes=json.load(sys.stdin)["result"]["process_info"].get("foreground_processes", []); print("yes" if any("hermes" in " ".join(str(p.get(k) or "") for k in ("name", "argv0", "cmdline")) for p in processes) else "no")')"
|
|
if [ "${coordinator_running}" != "yes" ]; then
|
|
herdr pane run "${pane}" /opt/hermes/.venv/bin/hermes
|
|
fi
|
|
wait "${server_pid}"
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: CODEX_HOME, value: /opt/data/home/.codex}
|
|
- {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
|
|
- {name: HERDR_CONFIG_PATH, value: /opt/data/home/.config/herdr/config.toml}
|
|
- {name: HERDR_SOCKET_PATH, value: /opt/data/herdr/herdr.sock}
|
|
- {name: PYTHONPATH, value: /opt/hermes}
|
|
- {name: PATH, value: /opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: provider-auth, mountPath: /shared-auth, readOnly: true}
|
|
- {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
|
|
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
|
- {name: coordinator, mountPath: /opt/data/home/.local/bin/herdr-dispatch, subPath: herdr_dispatch.py, readOnly: true}
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 2Gi}
|
|
- name: model-steward
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:15c5c538c0b58686af2e54e10bc870b23284789d485a609349df24ed3053622f
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/opt/hermes/.venv/bin/python, /opt/coordinator/hermes_coordinator.py, --loop, --interval, "3600"]
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: PYTHONPATH, value: /opt/hermes}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: provider-auth, mountPath: /shared-auth}
|
|
- {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
|
|
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: 250m, memory: 512Mi}
|
|
volumes:
|
|
- name: home
|
|
persistentVolumeClaim:
|
|
claimName: hermes-agent-home
|
|
- name: provider-auth
|
|
persistentVolumeClaim:
|
|
claimName: hermes-provider-auth
|
|
- name: config
|
|
configMap:
|
|
name: hermes-agent-config
|
|
- name: coordinator
|
|
configMap:
|
|
name: hermes-coordinator
|
|
defaultMode: 0555
|
|
- name: auth-patch
|
|
emptyDir: {}
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 256Mi
|