gcloud-lab/apps/base/customer1/hermes-agent/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-agent
  namespace: customer1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hermes-agent
  template:
    metadata:
      labels:
        app: hermes-agent
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      #initContainers:
      #- name: fix-webui-perms
       # image: alpine:3.20
        #imagePullPolicy: IfNotPresent
        #securityContext:
         # runAsNonRoot: false
          #runAsUser: 0
         # allowPrivilegeEscalation: false
          #seccompProfile:
           # type: RuntimeDefault
        #command:
        #  - sh
         # - -c
       # args:
        #  - |
         #   apk add --no-cache git 
          #  mkdir -p /data/.hermes/webui \
           #          /data/.hermes/logs \
            #         /data/.hermes/sessions \
             #        /data/.cache \
              #       /data/.config \
               #      /data/bin  
           # touch /data/.hermes/sessions/sessions.json

           # chmod -R g+rwX,o-rwx /data
            #chown -R 1000:1000 /data/.hermes /data/.cache /data/.config /data/bin || true
           # chown -R 1024:1024 /data/.hermes/webui || true
            #echo "✅ Hermes data permissions fixed (agent=1000, webui=1024)"
           # if [ ! -d "/data/hermes-agent" ]; then
            #  echo "Cloning hermes-agent source..."
             # git clone https://github.com/NousResearch/hermes-agent.git /data/hermes-agent
              #echo "hermes-agent source cloned successfully"
           # else
            #  echo "hermes-agent source already present"
           # fi
            # Full write permissions for webui user (fixes egg-info + logs)
            #chown -R 1024:1024 /data/hermes-agent /data/.hermes/logs || true
           # chmod -R 777 /data/hermes-agent /data/.hermes/logs || true
           # echo "✅ Full permissions applied to hermes-agent and logs"


       # volumeMounts:
        #  - name: hermes-data
         #   mountPath: /data
      
      containers:
      - name: hermes-agent
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          runAsGroup: 1000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
        image: nousresearch/hermes-agent:latest
        ports:
        -  containerPort: 8642 
        command: ["/bin/bash", "-c"]
        
        args:
          - |
            set -euo pipefail
            echo "Hermes Agent starting (Telegram polling + full config persistence)..."

            HERMES_BIN="/home/hermes/.venv/bin/hermes"

            if [ ! -x "$HERMES_BIN" ]; then
              echo "❌ hermes binary NOT FOUND at $HERMES_BIN"
              echo "Searching filesystem..."
              find / -name hermes -type f 2>/dev/null | head -10 || true
              exit 1
            fi

            echo "✅ Found hermes at: $HERMES_BIN"

            # Copy config
            cp -f /tmp/hermes/config.yaml /home/hermes/.config/config.yaml || true

            # Create symlink in a writable location (PVC) so it works when you exec in
            mkdir -p /opt/data/bin
            ln -sf "$HERMES_BIN" /home/hermes/bin || true
            export PATH="/home/hermes/bin:$PATH"

            echo "🚀 Starting hermes gateway..."
            exec "$HERMES_BIN" gateway run
        env:
          # === Hermes Home - REQUIRED for config persistence ===
          - name: HERMES_HOME
            value: "/home/hermes/.hermes" 
          - name: XDG_CACHE_HOME
            value: "/home/hermes/.cache"
          - name: XDG_CONFIG_HOME
            value: "/home/hermes/.config"

          # === Telegram Configuration (polling only - no public exposure) ===
          - name: TELEGRAM_BOT_TOKEN
            valueFrom:
              secretKeyRef:
                name: hermes-secrets
                key: TELEGRAM_BOT_TOKEN 
          - name: XAI_API_KEY
            valueFrom:
              secretKeyRef:
                name: xai-apikey
                key: XAI_API_KEY 
                
          - name: TELEGRAM_ALLOWED_USERS
            value: "7528130947"        

          # === Local vLLM (OpenAI-compatible) ===
          - name: OPENAI_BASE_URL
            value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1"   # ← adjust if your service name differs
          
          - name: HERMES_MODEL_PROVIDER
            value: xai
          
          - name: HERMES_MODEL 
            value: grok-4.20-0309-reasoning
          
          - name: OPENAI_API_KEY
            value: "dummy"                                 # vLLM ignores this

          # === API Server (for external OpenAI-compatible clients) ===
          - name: API_SERVER_ENABLED
            value: "true"
          - name: API_SERVER_HOST
            value: "0.0.0.0"
          - name: API_SERVER_PORT
            value: "8642"
          - name: API_SERVER_KEY
            value: ""  # empty = no auth (tailnet-only, private)
          - name: API_SERVER_MODEL_NAME
            value: "hermes-agent"

          # === Optional ===
          # - name: LOG_LEVEL
          #   value: "INFO"
        volumeMounts:
        - name: hermes-data
          mountPath: /home/hermes/.hermes 
        - name: hermes-configmap
          mountPath: /tmp/hermes/config.yaml
          subPath: config.yaml
          readOnly: true
        - name: hermes-bin
          mountPath: /home/hermes/bin
        
        resources:
          requests:
            memory: 2Gi
            cpu: "1"
          limits:
            memory: 3Gi
            cpu: "2"
     
      - name: hermes-webui
        image: ghcr.io/nesquena/hermes-webui:latest
        ports:
        - containerPort: 8787
        
        env:
          - name: HERMES_HOME
            value: "/home/hermeswebui/.hermes"
          - name: HERMES_WEBUI_AGENT_DIR
            value: "/home/hermeswebui/.hermes/bin"
          - name: HERMES_WEBUI_HOST
            value: "0.0.0.0"
          - name: HERMES_WEBUI_PORT
            value: "8787"
          - name: HERMES_WEBUI_STATE_DIR
            value: "/home/hermeswebui/.hermes/webui"
          - name: WANTED_UID
            value: "1024"
          - name: WANTED_GID
            value: "1000"
        
        volumeMounts:
        - name: hermes-data
          mountPath: /home/hermeswebui/.hermes
        - name: hermes-bin 
          mountPath: /home/hermeswebui/.hermes/bin 
        - name: hermes-workspace
          mountPath: /home/hermeswebui/workspace 
        
        resources:
          requests:
            memory: 500Mi
            cpu: "100m"
          limits:
            memory: 1Gi
            cpu: "500m"
        
        securityContext:
          
          runAsUser: 1024
          runAsGroup: 1000
          runAsNonRoot: false
          allowPrivilegeEscalation: true
          readOnlyRootFilesystem: false
          
            
            
          seccompProfile:
            type: RuntimeDefault
      volumes:
      - name: hermes-configmap
        configMap:
          name: hermes-config
      
      - name: hermes-data
        persistentVolumeClaim:
          claimName: hermes-agent-pvc
      
      - name: hermes-workspace
        emptyDir: {} 
      
        
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: hermes-agent-pvc
  namespace: customer1
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 25Gi