- Updated pod.spec.securityContext and all container/initContainer securityContext to be fully compliant with restricted:latest (runAsNonRoot: true, allowPrivilegeEscalation: false, runAsUser: 1000, capabilities drop ALL, seccomp RuntimeDefault, fsGroup)
- Changed initContainer from root chown to non-root mkdir/chmod relying on fsGroup (avoids PSA violation)
- Updated default model to grok-4.20-0309-reasoning (per xAI switch note)
- Added automountServiceAccountToken: false and imagePullPolicy for best practices (matches openclaw deployment pattern)
- hermes-webui now runs as non-root with WANTED_UID matching
This should resolve the container not starting. Leave PR open for review before merge.
- Removes pod runAsNonRoot/runAsUser to allow init runAsUser: 0
- chowns PVC to 1000:1000 + g+rwX (fixes legacy root-owned files)
- webui can now mkdir/write state dir
- whoami log non-fatal; runtime non-root
- Removed initContainer running as root (violates PodSecurity restricted:latest)
- Removed shared emptyDir /etc mount (no longer needed)
- Rely on fsGroup:1000 + runAsUser:1000 for volume ownership and container UID
- Added runAsNonRoot: true to podSecurityContext and both containers for policy compliance
Pod will now start, webui runs as UID 1000 == WANTED_UID, init.bash skips chown/sudo.
Swap the generic Open WebUI frontend for the purpose-built
hermes-webui (nesquena) with full CLI parity:
- 3-panel layout: sessions, chat, workspace file browser
- Native session, cron, skills, memory, profile management
- Themes (dark/light/slate/solarized/monokai/nord/oled)
- Mobile responsive
- Sidecar container sharing the hermes-agent PVC
- Exposed via Tailscale on port 8787 (plain HTTP)
Access: http://hermes-webui.tail14a963.ts.net:8787
tailscale.com/https-only: 'false' still attempts TLS termination,
causing ERR_SSL_PROTOCOL_ERROR when the backend speaks plain HTTP.
Replaced with tailscale.com/ports: 'http:8080' to explicitly tell
the operator to serve unencrypted HTTP on this port.
Tailscale defaults to HTTPS (443) but Open WebUI only serves HTTP (8080).
- Add tailscale.com/https-only: "false" annotation
- Now hermes-webui.tail14a963.ts.net:8080 works without SSL errors
Fixes ERR_SSL_PROTOCOL_ERROR
Open WebUI crashes on startup because it can't write its SQLite database to
/app/backend/data.
- Add emptyDir volume at /app/backend/data
- Pod restarts will lose data (dev-only acceptable)
Fixes pod crash: peewee.OperationalError: unable to open database file
- Enable Hermes API Server (port 8642) in gateway deployment
- Add Open WebUI deployment connected to Hermes API Server
- Expose Open WebUI via Tailscale using Service annotations
- Create ClusterIP Service for Hermes Agent API Server
- All deployments follow PodSecurity restricted policy
