Merge pull request #98 from sirius0xdev/feat/open-webui-tailscale

feat: add Open WebUI with Tailscale exposure

apps/base/customer1/hermes-agent/api-server-configmap.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hermes-api-server
+  namespace: customer1
+data:
+  API_SERVER_ENABLED: "true"
+  API_SERVER_HOST: "0.0.0.0"
+  API_SERVER_KEY: ""  # TODO: set a key or leave empty for tailnet-only
+  API_SERVER_PORT: "8642"
+  API_SERVER_MODEL_NAME: "hermes-agent"

apps/base/customer1/hermes-agent/deployment.yaml

@@ -58,6 +58,18 @@ spec:
           - name: OPENAI_API_KEY
             value: "dummy"                                 # vLLM ignores this
 
+          # === API Server (for Open WebUI) ===
+          - name: API_SERVER_ENABLED
+            value: "true"
+          - name: API_SERVER_HOST
+            value: "0.0.0.0"
+          - name: API_SERVER_PORT
+            value: "8642"
+          - name: API_SERVER_KEY
+            value: ""  # empty = no auth (tailnet-only, private)
+          - name: API_SERVER_MODEL_NAME
+            value: "hermes-agent"
+
           # === Optional ===
           # - name: LOG_LEVEL
           #   value: "INFO"

apps/base/customer1/hermes-agent/hermes-service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-agent-service
+  namespace: customer1
+spec:
+  selector:
+    app: hermes-agent
+  ports:
+    - name: api-server
+      port: 8642
+      targetPort: 8642

apps/base/customer1/hermes-agent/kustomization.yaml

@@ -6,3 +6,7 @@ resources:
   - configmap.yaml
   - rays-hermes-secret.yaml
   - rays-deployment.yaml
+  - api-server-configmap.yaml
+  - open-webui-deployment.yaml
+  - open-webui-service.yaml
+  - hermes-service.yaml

apps/base/customer1/hermes-agent/open-webui-deployment.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: open-webui
+  namespace: customer1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: open-webui
+  template:
+    metadata:
+      labels:
+        app: open-webui
+    spec:
+      containers:
+      - name: open-webui
+        image: ghcr.io/open-webui/open-webui:main
+        ports:
+        - containerPort: 8080
+        env:
+          # Connect to Hermes API Server
+          - name: OPENAI_API_BASE_URL
+            value: "http://hermes-agent-service.customer1.svc.cluster.local:8642/v1"
+          - name: OPENAI_API_KEY
+            valueFrom:
+              configMapKeyRef:
+                name: hermes-api-server
+                key: API_SERVER_KEY
+          # Open WebUI settings
+          - name: WEBUI_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: hermes-secrets
+                key: TELEGRAM_BOT_TOKEN  # reuse as secret seed (any opaque string works)
+          - name: ENABLE_OPENAI_MODELS
+            value: "true"
+          - name: OPENAI_API_FORMAT
+            value: "hermes-agent"
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: "250m"
+          limits:
+            memory: 1Gi
+            cpu: "500m"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000

apps/base/customer1/hermes-agent/open-webui-service.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: open-webui-service
+  namespace: customer1
+  annotations:
+    tailscale.com/proxy: "true"
+    tailscale.com/hostname: "hermes-webui"
+spec:
+  selector:
+    app: open-webui
+  ports:
+    - port: 80
+      targetPort: 8080
+      name: http