Merge branch 'main' of https://git.rogi.casa/roger/k3s-cluster

Reviewed-on: #26

myorg-assistant/cronjobs/git-sync.yaml

@@ -31,12 +31,8 @@ spec:
             - sh
             - -c
             - |
-              # Normalize the repo URL host to the correct Gitea subdomain.
-              # The GIT_REPO_URL secret historically contained gitea.rogi.casa,
-              # which 526s through Cloudflare; the working subdomain is git.rogi.casa.
-              export GIT_REPO_URL="$(echo "${GIT_REPO_URL}" | sed -E 's#https?://[^/@]+@?gitea\.rogi\.casa#https://'"${GIT_USERNAME}"':'"${GIT_TOKEN}"'@git.rogi.casa#')"
               if [ ! -d /data/myorg/.git ]; then
-                echo "Cloning repository from ${GIT_REPO_URL}..."
+                echo "Cloning repository..."
                 git clone ${GIT_REPO_URL} /data/myorg
                 cd /data/myorg
                 git config user.name "${GIT_USERNAME}"

openwebui/ingress.yaml

@@ -9,10 +9,10 @@ spec:
   ingressClassName: traefik
   tls:
   - hosts:
-    - openai.rogi.casa
+    - ai.rogi.casa
     secretName: openwebui-tls
   rules:
-  - host: openai.rogi.casa
+  - host: ai.rogi.casa
     http:
       paths:
         - path: /

platform-engineer/deployment.yaml

@@ -125,6 +125,13 @@ spec:
         env:
         - name: HERMES_HOME
           value: /opt/data
+        # Hermes' file-write tool refuses any path outside HERMES_WRITE_SAFE_ROOT.
+        # When unset it defaults to HERMES_HOME (/opt/data), which blocks the
+        # agent's only GitOps remediation path (editing manifests under
+        # /workspace/k3s-cluster). Whitelist the whole filesystem — consistent
+        # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
+        - name: HERMES_WRITE_SAFE_ROOT
+          value: "/"
         volumeMounts:
         - name: data
           mountPath: /opt/data