feat(roles): onboard hermes, homeassistant, litellm and openclaw to tor

Four roles gained a canonical domain without a tor service block. Declare it
the way 84b22b37a8 did for n8n: bond 0.5, enabled on 'svc-net-tor' in
group_names, shared, with the variant pins alongside.

The nocheck directives carry the two exemptions: the service has no persona
surface for the playwright flag, and the sso-variant-tor combination requires
the onion in every variant, so the false polarity has no variant left to
live in.

hermes also moves its local http port from 8089 to 8092, because 8089
belongs to web-app-socialhome. That is a separate concern riding along in the
same file; splitting it would need interactive staging.

This is merge work rather than authored here: it follows the established
pattern and the port collision is real, but none of it has been deployed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-hermes/meta/services.yml

@@ -23,7 +23,7 @@ hermes:
   pids_limit: 2048
   ports:
     local:
-      http: 8089
+      http: 8092
       sso: 16512
     internal:
       http: 8642
@@ -85,6 +85,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1

roles/web-app-hermes/meta/variants.yml

@@ -26,6 +26,8 @@
     homeassistant:
       enabled: true
       shared: true
+    tor:
+      enabled: true
   mcp:
     enabled: true
     shared: true
@@ -54,6 +56,8 @@
     homeassistant:
       enabled: false
       shared: false # nocheck: variants-static-override variant pins a literal off-switch
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false

roles/web-app-homeassistant/meta/services.yml

@@ -52,6 +52,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1

roles/web-app-homeassistant/meta/variants.yml

@@ -11,6 +11,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
   mcp:
     enabled: true
@@ -25,6 +27,8 @@
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false

roles/web-app-litellm/meta/services.yml

@@ -22,6 +22,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: sso, dynamic-flag, playwright-service-flag
 sso:
   enabled: false

roles/web-app-litellm/meta/variants.yml

@@ -9,6 +9,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 - services:
     dashboard:
@@ -17,3 +19,5 @@
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true

roles/web-app-openclaw/meta/services.yml

@@ -78,6 +78,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1

roles/web-app-openclaw/meta/variants.yml

@@ -29,6 +29,8 @@
     homeassistant:
       enabled: true
       shared: true
+    tor:
+      enabled: true
   mcp:
     enabled: true
     shared: true
@@ -60,6 +62,8 @@
     homeassistant:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false