enable api access for agents home manager and platform engineer

home-manager/deployment.yaml

@@ -63,7 +63,8 @@ spec:
                      DISCORD_BOT_TOKEN DISCORD_HOME_CHANNEL \
                      GATEWAY_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
                      HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
-                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do
+                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \
+                     API_SERVER_KEY; do
               eval "v=\${$k:-}"
               [ -n "$v" ] && echo "$k=$v" >> /opt/data/.env
             done
@@ -103,6 +104,14 @@ spec:
         # it lives here rather than in the Secret. The SOUL.md uses $HOMEASSISTANT_URL.
         - name: HOMEASSISTANT_URL
           value: "http://home-assistant.home-assistant:80"
+        # Expose the Hermes gateway HTTP API on port 8642 (the Service routes
+        # 80 → 8642). Used by Open WebUI and other in-cluster clients to talk
+        # to the agent as an OpenAI-compatible endpoint.
+        - name: API_SERVER_ENABLED
+          value: "true"
+        # NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom)
+        # and is also seeded into /opt/data/.env by the init container. Clients
+        # (e.g. Open WebUI) authenticate with `Authorization: Bearer <key>`.
         # HERMES_WRITE_SAFE_ROOT is intentionally unset → defaults to HERMES_HOME
         # (/opt/data). The home agent has no git workspace to write to, so the
         # tighter default is correct (memory/skills/scripts live under /opt/data).
@@ -118,7 +127,8 @@ spec:
             cpu: "1000m"
         livenessProbe:
           # Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1
-          # and binds 0.0.0.0). The gateway API on 8642 is off by default.
+          # and binds 0.0.0.0). The gateway API on 8642 is enabled via
+          # API_SERVER_ENABLED=true above.
           tcpSocket:
             port: 9119
           initialDelaySeconds: 90

platform-engineer/deployment.yaml

@@ -89,7 +89,8 @@ spec:
                      DISCORD_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
                      GITEA_TOKEN GITEA_REPO_URL ARGOCD_API_TOKEN ARGOCD_SERVER \
                      HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
-                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do
+                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \
+                     API_SERVER_KEY; do
               eval "v=\${$k:-}"
               [ -n "$v" ] && echo "$k=$v" >> /opt/data/.env
             done
@@ -132,6 +133,14 @@ spec:
         # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
         - name: HERMES_WRITE_SAFE_ROOT
           value: "/"
+        # Expose the Hermes gateway HTTP API on port 8642 (the Service routes
+        # 80 → 8642). Used by Open WebUI and other in-cluster clients to talk
+        # to the agent as an OpenAI-compatible endpoint.
+        - name: API_SERVER_ENABLED
+          value: "true"
+        # NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom)
+        # and is also seeded into /opt/data/.env by the init container. Clients
+        # (e.g. Open WebUI) authenticate with `Authorization: Bearer <key>`.
         volumeMounts:
         - name: data
           mountPath: /opt/data
@@ -146,7 +155,8 @@ spec:
             cpu: "1000m"
         livenessProbe:
           # Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1
-          # and binds 0.0.0.0). The gateway API on 8642 is off by default.
+          # and binds 0.0.0.0). The gateway API on 8642 is enabled via
+          # API_SERVER_ENABLED=true above.
           tcpSocket:
             port: 9119
           initialDelaySeconds: 90