From 214133d06205a0398d1129487d331bc6c1276750 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Wed, 6 May 2026 15:36:27 +0000
Subject: [PATCH] feat: add Open WebUI with Tailscale exposure

- Enable Hermes API Server (port 8642) in gateway deployment
- Add Open WebUI deployment connected to Hermes API Server
- Expose Open WebUI via Tailscale using Service annotations
- Create ClusterIP Service for Hermes Agent API Server
- All deployments follow PodSecurity restricted policy
---
 .../hermes-agent/api-server-configmap.yaml    | 12 ++++
 .../customer1/hermes-agent/deployment.yaml    | 12 ++++
 .../hermes-agent/hermes-service.yaml          | 13 ++++
 .../customer1/hermes-agent/kustomization.yaml |  4 ++
 .../hermes-agent/open-webui-deployment.yaml   | 59 +++++++++++++++++++
 .../hermes-agent/open-webui-service.yaml      | 16 +++++
 6 files changed, 116 insertions(+)
 create mode 100644 apps/base/customer1/hermes-agent/api-server-configmap.yaml
 create mode 100644 apps/base/customer1/hermes-agent/hermes-service.yaml
 create mode 100644 apps/base/customer1/hermes-agent/open-webui-deployment.yaml
 create mode 100644 apps/base/customer1/hermes-agent/open-webui-service.yaml

diff --git a/apps/base/customer1/hermes-agent/api-server-configmap.yaml b/apps/base/customer1/hermes-agent/api-server-configmap.yaml
new file mode 100644
index 0000000..7a89f73
--- /dev/null
+++ b/apps/base/customer1/hermes-agent/api-server-configmap.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hermes-api-server
+  namespace: customer1
+data:
+  API_SERVER_ENABLED: "true"
+  API_SERVER_HOST: "0.0.0.0"
+  API_SERVER_KEY: ""  # TODO: set a key or leave empty for tailnet-only
+  API_SERVER_PORT: "8642"
+  API_SERVER_MODEL_NAME: "hermes-agent"
diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index bee1cb8..8f80fbb 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -58,6 +58,18 @@ spec:
           - name: OPENAI_API_KEY
             value: "dummy"                                 # vLLM ignores this
 
+          # === API Server (for Open WebUI) ===
+          - name: API_SERVER_ENABLED
+            value: "true"
+          - name: API_SERVER_HOST
+            value: "0.0.0.0"
+          - name: API_SERVER_PORT
+            value: "8642"
+          - name: API_SERVER_KEY
+            value: ""  # empty = no auth (tailnet-only, private)
+          - name: API_SERVER_MODEL_NAME
+            value: "hermes-agent"
+
           # === Optional ===
           # - name: LOG_LEVEL
           #   value: "INFO"
diff --git a/apps/base/customer1/hermes-agent/hermes-service.yaml b/apps/base/customer1/hermes-agent/hermes-service.yaml
new file mode 100644
index 0000000..7fe7f4c
--- /dev/null
+++ b/apps/base/customer1/hermes-agent/hermes-service.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-agent-service
+  namespace: customer1
+spec:
+  selector:
+    app: hermes-agent
+  ports:
+    - name: api-server
+      port: 8642
+      targetPort: 8642
diff --git a/apps/base/customer1/hermes-agent/kustomization.yaml b/apps/base/customer1/hermes-agent/kustomization.yaml
index 040de28..e136512 100644
--- a/apps/base/customer1/hermes-agent/kustomization.yaml
+++ b/apps/base/customer1/hermes-agent/kustomization.yaml
@@ -6,3 +6,7 @@ resources:
   - configmap.yaml
   - rays-hermes-secret.yaml
   - rays-deployment.yaml
+  - api-server-configmap.yaml
+  - open-webui-deployment.yaml
+  - open-webui-service.yaml
+  - hermes-service.yaml
diff --git a/apps/base/customer1/hermes-agent/open-webui-deployment.yaml b/apps/base/customer1/hermes-agent/open-webui-deployment.yaml
new file mode 100644
index 0000000..5c209e4
--- /dev/null
+++ b/apps/base/customer1/hermes-agent/open-webui-deployment.yaml
@@ -0,0 +1,59 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: open-webui
+  namespace: customer1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: open-webui
+  template:
+    metadata:
+      labels:
+        app: open-webui
+    spec:
+      containers:
+      - name: open-webui
+        image: ghcr.io/open-webui/open-webui:main
+        ports:
+        - containerPort: 8080
+        env:
+          # Connect to Hermes API Server
+          - name: OPENAI_API_BASE_URL
+            value: "http://hermes-agent-service.customer1.svc.cluster.local:8642/v1"
+          - name: OPENAI_API_KEY
+            valueFrom:
+              configMapKeyRef:
+                name: hermes-api-server
+                key: API_SERVER_KEY
+          # Open WebUI settings
+          - name: WEBUI_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: hermes-secrets
+                key: TELEGRAM_BOT_TOKEN  # reuse as secret seed (any opaque string works)
+          - name: ENABLE_OPENAI_MODELS
+            value: "true"
+          - name: OPENAI_API_FORMAT
+            value: "hermes-agent"
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: "250m"
+          limits:
+            memory: 1Gi
+            cpu: "500m"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
diff --git a/apps/base/customer1/hermes-agent/open-webui-service.yaml b/apps/base/customer1/hermes-agent/open-webui-service.yaml
new file mode 100644
index 0000000..a8390ad
--- /dev/null
+++ b/apps/base/customer1/hermes-agent/open-webui-service.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: open-webui-service
+  namespace: customer1
+  annotations:
+    tailscale.com/proxy: "true"
+    tailscale.com/hostname: "hermes-webui"
+spec:
+  selector:
+    app: open-webui
+  ports:
+    - port: 80
+      targetPort: 8080
+      name: http