Merge branch 'main' of https://git.rogi.casa/roger/k3s-cluster

openwebui/ingress.yaml

@@ -9,10 +9,10 @@ spec:
   ingressClassName: traefik
   tls:
   - hosts:
-    - openai.rogi.casa
+    - ai.rogi.casa
     secretName: openwebui-tls
   rules:
-  - host: openai.rogi.casa
+  - host: ai.rogi.casa
     http:
       paths:
         - path: /

platform-engineer/deployment.yaml

@@ -125,6 +125,13 @@ spec:
         env:
         - name: HERMES_HOME
           value: /opt/data
+        # Hermes' file-write tool refuses any path outside HERMES_WRITE_SAFE_ROOT.
+        # When unset it defaults to HERMES_HOME (/opt/data), which blocks the
+        # agent's only GitOps remediation path (editing manifests under
+        # /workspace/k3s-cluster). Whitelist the whole filesystem — consistent
+        # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
+        - name: HERMES_WRITE_SAFE_ROOT
+          value: "/"
         volumeMounts:
         - name: data
           mountPath: /opt/data