Files
computer-playbook/roles/web-app-hermes/meta/domains.yml
kevinveenbirkenbachandClaude Opus 4.8 5d72ddc357 feat(web-app-hermes): deploy the Hermes agent under an isolating runtime
The first agent workload of requirement 032. Its compose service pins
runtime: to the fact svc-virt-kata publishes, so model-generated code
runs behind a kernel or syscall boundary rather than plain runc. The pin
goes through compose_only because docker stack deploy discards the key;
swarm relies on the node-default runtime and a placement constraint
instead.

Hermes is not a dashboard. The container starts its gateway and serves an
OpenAI-compatible API on 8642, which shapes three decisions: the env
block configures API_SERVER_*, inference points OLLAMA_BASE_URL at the
LiteLLM gateway (Hermes' Ollama client speaks the same wire format), and
the vhost declares status_codes [200, 404] because the API server maps
only /health and /v1/*, so the bare root answers 404 by design and the
webserver health unit would otherwise fail the host.

SSO is off deliberately: an oauth2 proxy in front of a bearer-token API
breaks OpenAI-compatible clients. Authentication is API_SERVER_KEY, and
the guest spec asserts that /v1/models without it is rejected while the
administrator spec asserts the key unlocks the listing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-25 19:08:32 +02:00

5 lines
68 B
YAML

---
canonical:
hermes: hermes.ai.{{ DOMAIN_PRIMARY }}
aliases: []