From cd1f07a91ea9ed6eb53b68d3ccba904f76dc2bc2 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Fri, 28 Aug 2026 12:48:10 +0200 Subject: [PATCH] feat(roles): onboard hermes, homeassistant, litellm and openclaw to tor Four roles gained a canonical domain without a tor service block. Declare it the way 84b22b37a8 did for n8n: bond 0.5, enabled on 'svc-net-tor' in group_names, shared, with the variant pins alongside. The nocheck directives carry the two exemptions: the service has no persona surface for the playwright flag, and the sso-variant-tor combination requires the onion in every variant, so the false polarity has no variant left to live in. hermes also moves its local http port from 8089 to 8092, because 8089 belongs to web-app-socialhome. That is a separate concern riding along in the same file; splitting it would need interactive staging. This is merge work rather than authored here: it follows the established pattern and the port collision is real, but none of it has been deployed. Co-Authored-By: Claude Opus 5 (1M context) --- roles/web-app-hermes/meta/services.yml | 9 ++++++++- roles/web-app-hermes/meta/variants.yml | 4 ++++ roles/web-app-homeassistant/meta/services.yml | 7 +++++++ roles/web-app-homeassistant/meta/variants.yml | 4 ++++ roles/web-app-litellm/meta/services.yml | 7 +++++++ roles/web-app-litellm/meta/variants.yml | 4 ++++ roles/web-app-openclaw/meta/services.yml | 7 +++++++ roles/web-app-openclaw/meta/variants.yml | 4 ++++ 8 files changed, 45 insertions(+), 1 deletion(-) diff --git a/roles/web-app-hermes/meta/services.yml b/roles/web-app-hermes/meta/services.yml index de4d9caa84..45556f0994 100644 --- a/roles/web-app-hermes/meta/services.yml +++ b/roles/web-app-hermes/meta/services.yml @@ -23,7 +23,7 @@ hermes: pids_limit: 2048 ports: local: - http: 8089 + http: 8092 sso: 16512 internal: http: 8642 @@ -85,6 +85,13 @@ prometheus: enabled: "{{ 'web-app-prometheus' in group_names }}" shared: "{{ 'web-app-prometheus' in group_names }}" +# nocheck: playwright-service-flag +# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in +tor: + bond: 0.5 + enabled: "{{ 'svc-net-tor' in group_names }}" + shared: true # nocheck: dynamic-flag + # nocheck: playwright-service-flag, dynamic-flag container_backup: # nocheck: bond-baseline bond: 1 diff --git a/roles/web-app-hermes/meta/variants.yml b/roles/web-app-hermes/meta/variants.yml index 450cb3fbe0..dd05f7e29e 100644 --- a/roles/web-app-hermes/meta/variants.yml +++ b/roles/web-app-hermes/meta/variants.yml @@ -26,6 +26,8 @@ homeassistant: enabled: true shared: true + tor: + enabled: true mcp: enabled: true shared: true @@ -54,6 +56,8 @@ homeassistant: enabled: false shared: false # nocheck: variants-static-override variant pins a literal off-switch + tor: + enabled: true mcp: enabled: false shared: false diff --git a/roles/web-app-homeassistant/meta/services.yml b/roles/web-app-homeassistant/meta/services.yml index 3e32f5deab..d47e4fa7c2 100644 --- a/roles/web-app-homeassistant/meta/services.yml +++ b/roles/web-app-homeassistant/meta/services.yml @@ -52,6 +52,13 @@ prometheus: enabled: "{{ 'web-app-prometheus' in group_names }}" shared: "{{ 'web-app-prometheus' in group_names }}" +# nocheck: playwright-service-flag +# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in +tor: + bond: 0.5 + enabled: "{{ 'svc-net-tor' in group_names }}" + shared: true # nocheck: dynamic-flag + # nocheck: playwright-service-flag, dynamic-flag container_backup: # nocheck: bond-baseline bond: 1 diff --git a/roles/web-app-homeassistant/meta/variants.yml b/roles/web-app-homeassistant/meta/variants.yml index d699f3d040..db46ef885d 100644 --- a/roles/web-app-homeassistant/meta/variants.yml +++ b/roles/web-app-homeassistant/meta/variants.yml @@ -11,6 +11,8 @@ prometheus: enabled: true shared: true + tor: + enabled: true mcp: enabled: true @@ -25,6 +27,8 @@ prometheus: enabled: false shared: false # nocheck: variants-static-override backup shared stays literally true + tor: + enabled: true mcp: enabled: false shared: false diff --git a/roles/web-app-litellm/meta/services.yml b/roles/web-app-litellm/meta/services.yml index 72b1cf0845..b169fa89d3 100644 --- a/roles/web-app-litellm/meta/services.yml +++ b/roles/web-app-litellm/meta/services.yml @@ -22,6 +22,13 @@ prometheus: enabled: "{{ 'web-app-prometheus' in group_names }}" shared: "{{ 'web-app-prometheus' in group_names }}" +# nocheck: playwright-service-flag +# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in +tor: + bond: 0.5 + enabled: "{{ 'svc-net-tor' in group_names }}" + shared: true # nocheck: dynamic-flag + # nocheck: sso, dynamic-flag, playwright-service-flag sso: enabled: false diff --git a/roles/web-app-litellm/meta/variants.yml b/roles/web-app-litellm/meta/variants.yml index 0ce99af67b..0be5db4f58 100644 --- a/roles/web-app-litellm/meta/variants.yml +++ b/roles/web-app-litellm/meta/variants.yml @@ -9,6 +9,8 @@ prometheus: enabled: true shared: true + tor: + enabled: true - services: dashboard: @@ -17,3 +19,5 @@ prometheus: enabled: false shared: false # nocheck: variants-static-override backup shared stays literally true + tor: + enabled: true diff --git a/roles/web-app-openclaw/meta/services.yml b/roles/web-app-openclaw/meta/services.yml index 8f38af0667..f0e1fbd007 100644 --- a/roles/web-app-openclaw/meta/services.yml +++ b/roles/web-app-openclaw/meta/services.yml @@ -78,6 +78,13 @@ prometheus: enabled: "{{ 'web-app-prometheus' in group_names }}" shared: "{{ 'web-app-prometheus' in group_names }}" +# nocheck: playwright-service-flag +# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in +tor: + bond: 0.5 + enabled: "{{ 'svc-net-tor' in group_names }}" + shared: true # nocheck: dynamic-flag + # nocheck: playwright-service-flag, dynamic-flag container_backup: # nocheck: bond-baseline bond: 1 diff --git a/roles/web-app-openclaw/meta/variants.yml b/roles/web-app-openclaw/meta/variants.yml index 279ddc0413..9be935ceae 100644 --- a/roles/web-app-openclaw/meta/variants.yml +++ b/roles/web-app-openclaw/meta/variants.yml @@ -29,6 +29,8 @@ homeassistant: enabled: true shared: true + tor: + enabled: true mcp: enabled: true shared: true @@ -60,6 +62,8 @@ homeassistant: enabled: false shared: false # nocheck: variants-static-override backup shared stays literally true + tor: + enabled: true mcp: enabled: false shared: false