787bba2d33
Rename two public Hermes hostnames across the repo: chat.hermes.bstein.dev -> hermes.bstein.dev triage.hermes.bstein.dev -> triage.bstein.dev agent.hermes.bstein.dev is left untouched. That rename ships separately and must merge last, because it is the coordinator's own access point. Covers CoreDNS host entries, the shared hermes-sites certificate SANs and the ingress rules, Keycloak OIDC redirect/origin/post-logout URLs, oauth2-proxy redirect URLs, CORS and allowed-origin settings, dashboard public URLs, the Ariadne proposal UI link, ZAP baseline scan targets, the operator and agent instruction text, the Telegram sign-in prompts, and the Docker/UI references. Knowledge catalogs and the HTTP diagram were regenerated with scripts/render/knowledge_render_atlas.py rather than hand-edited. Only the rename delta is carried here: the committed catalogs on main are already stale by roughly 1650 lines, and that drift is left for a separate cleanup. Repo-only change. After merge it needs the Keycloak ensure script re-run and certificate reissuance; existing oauth2-proxy sessions are invalidated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
115 lines
2.9 KiB
YAML
115 lines
2.9 KiB
YAML
# services/hermes/agent-ingress.yaml
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: hermes-agent-terminal-slash
|
|
namespace: hermes
|
|
spec:
|
|
redirectRegex:
|
|
regex: ^https://agent\.hermes\.bstein\.dev/terminal$
|
|
replacement: https://agent.hermes.bstein.dev/terminal/
|
|
permanent: false
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: hermes-agent-stock-dashboard-headers
|
|
namespace: hermes
|
|
spec:
|
|
headers:
|
|
customRequestHeaders:
|
|
Origin: http://127.0.0.1:9119
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-agent-dashboard
|
|
namespace: hermes
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-stock-dashboard-headers@kubernetescrd
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- agent.hermes.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: agent.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-agent-terminal
|
|
namespace: hermes
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-terminal-slash@kubernetescrd
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- agent.hermes.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: agent.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /terminal
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-sites
|
|
namespace: hermes
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- agent.hermes.bstein.dev
|
|
- hermes.bstein.dev
|
|
- triage.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-chat
|
|
port:
|
|
name: http
|
|
- host: triage.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-triage
|
|
port:
|
|
name: http
|