92ec0c0297
Introduce worker.bstein.dev as the canonical hostname for the owner-only Hermes coordinator, previously agent.hermes.bstein.dev. The old host is deliberately kept alive. CoreDNS, both agent Ingresses and the hermes-sites certificate now serve BOTH names, so merging this cannot take away the endpoint the operator uses to reach the coordinator. Retiring agent.hermes.bstein.dev is a separate, separately scheduled change. No redirect middleware is added. What switches to the new host: - HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url - the Keycloak hermes-agent-proxy rootUrl - operator docs, skills, the ZAP baseline target and the triage monitor default What stays dual-homed until retirement: - CoreDNS hosts entry, both agent Ingress rules, certificate SANs - API_SERVER_CORS_ORIGINS (now a comma-separated pair) - the Keycloak redirect URIs, web origins and post-logout origins, so a rollback only needs the oauth2-proxy --redirect-url reverted and does not require re-running the ensure job ensure_proxy_client now takes optional trailing legacy URLs; called with a single URL it emits the identical payload as before, so the chat and triage clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it; login on the new host fails until that Job completes. Because the session and CSRF cookies use the __Host- prefix they are bound to one origin, so a fresh login must start on worker.bstein.dev and existing sessions do not carry over -- re-login is required after rollout. Knowledge catalogs and diagrams regenerated with `make knowledge`.
19 lines
519 B
YAML
19 lines
519 B
YAML
# services/hermes/agent-certificate.yaml
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: hermes-sites-tls
|
|
namespace: hermes
|
|
spec:
|
|
secretName: hermes-sites-tls
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: letsencrypt
|
|
dnsNames:
|
|
# worker.bstein.dev is the canonical owner-agent host. agent.hermes.bstein.dev
|
|
# stays on the certificate until the old host is retired in a separate change.
|
|
- agent.hermes.bstein.dev
|
|
- chat.bstein.dev
|
|
- triage.bstein.dev
|
|
- worker.bstein.dev
|