From 4f6255800b59effe7e4d2960c52b29b89b13b4d6 Mon Sep 17 00:00:00 2001 From: Roger Oriol Date: Sun, 26 Jul 2026 14:37:37 +0200 Subject: [PATCH] enable api access for agents home manager and platform engineer --- home-manager/deployment.yaml | 14 ++++++++++++-- platform-engineer/deployment.yaml | 14 ++++++++++++-- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/home-manager/deployment.yaml b/home-manager/deployment.yaml index 9c9689b..e69da4b 100644 --- a/home-manager/deployment.yaml +++ b/home-manager/deployment.yaml @@ -63,7 +63,8 @@ spec: DISCORD_BOT_TOKEN DISCORD_HOME_CHANNEL \ GATEWAY_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \ HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \ - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do + HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \ + API_SERVER_KEY; do eval "v=\${$k:-}" [ -n "$v" ] && echo "$k=$v" >> /opt/data/.env done @@ -103,6 +104,14 @@ spec: # it lives here rather than in the Secret. The SOUL.md uses $HOMEASSISTANT_URL. - name: HOMEASSISTANT_URL value: "http://home-assistant.home-assistant:80" + # Expose the Hermes gateway HTTP API on port 8642 (the Service routes + # 80 → 8642). Used by Open WebUI and other in-cluster clients to talk + # to the agent as an OpenAI-compatible endpoint. + - name: API_SERVER_ENABLED + value: "true" + # NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom) + # and is also seeded into /opt/data/.env by the init container. Clients + # (e.g. Open WebUI) authenticate with `Authorization: Bearer `. # HERMES_WRITE_SAFE_ROOT is intentionally unset → defaults to HERMES_HOME # (/opt/data). The home agent has no git workspace to write to, so the # tighter default is correct (memory/skills/scripts live under /opt/data). @@ -118,7 +127,8 @@ spec: cpu: "1000m" livenessProbe: # Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1 - # and binds 0.0.0.0). The gateway API on 8642 is off by default. + # and binds 0.0.0.0). The gateway API on 8642 is enabled via + # API_SERVER_ENABLED=true above. tcpSocket: port: 9119 initialDelaySeconds: 90 diff --git a/platform-engineer/deployment.yaml b/platform-engineer/deployment.yaml index 2221040..05eb63d 100644 --- a/platform-engineer/deployment.yaml +++ b/platform-engineer/deployment.yaml @@ -89,7 +89,8 @@ spec: DISCORD_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \ GITEA_TOKEN GITEA_REPO_URL ARGOCD_API_TOKEN ARGOCD_SERVER \ HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \ - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do + HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \ + API_SERVER_KEY; do eval "v=\${$k:-}" [ -n "$v" ] && echo "$k=$v" >> /opt/data/.env done @@ -132,6 +133,14 @@ spec: # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC. - name: HERMES_WRITE_SAFE_ROOT value: "/" + # Expose the Hermes gateway HTTP API on port 8642 (the Service routes + # 80 → 8642). Used by Open WebUI and other in-cluster clients to talk + # to the agent as an OpenAI-compatible endpoint. + - name: API_SERVER_ENABLED + value: "true" + # NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom) + # and is also seeded into /opt/data/.env by the init container. Clients + # (e.g. Open WebUI) authenticate with `Authorization: Bearer `. volumeMounts: - name: data mountPath: /opt/data @@ -146,7 +155,8 @@ spec: cpu: "1000m" livenessProbe: # Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1 - # and binds 0.0.0.0). The gateway API on 8642 is off by default. + # and binds 0.0.0.0). The gateway API on 8642 is enabled via + # API_SERVER_ENABLED=true above. tcpSocket: port: 9119 initialDelaySeconds: 90