enable api access for agents home manager and platform engineer

platform-engineer/deployment.yaml

@@ -89,7 +89,8 @@ spec:
                      DISCORD_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
                      GITEA_TOKEN GITEA_REPO_URL ARGOCD_API_TOKEN ARGOCD_SERVER \
                      HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
-                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do
+                     HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \
+                     API_SERVER_KEY; do
               eval "v=\${$k:-}"
               [ -n "$v" ] && echo "$k=$v" >> /opt/data/.env
             done
@@ -132,6 +133,14 @@ spec:
         # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
         - name: HERMES_WRITE_SAFE_ROOT
           value: "/"
+        # Expose the Hermes gateway HTTP API on port 8642 (the Service routes
+        # 80 → 8642). Used by Open WebUI and other in-cluster clients to talk
+        # to the agent as an OpenAI-compatible endpoint.
+        - name: API_SERVER_ENABLED
+          value: "true"
+        # NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom)
+        # and is also seeded into /opt/data/.env by the init container. Clients
+        # (e.g. Open WebUI) authenticate with `Authorization: Bearer <key>`.
         volumeMounts:
         - name: data
           mountPath: /opt/data
@@ -146,7 +155,8 @@ spec:
             cpu: "1000m"
         livenessProbe:
           # Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1
-          # and binds 0.0.0.0). The gateway API on 8642 is off by default.
+          # and binds 0.0.0.0). The gateway API on 8642 is enabled via
+          # API_SERVER_ENABLED=true above.
           tcpSocket:
             port: 9119
           initialDelaySeconds: 90