apiVersion: apps/v1
kind: Deployment
metadata:
  name: rays-hermes-agent
  namespace: customer1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rays-hermes-agent
  template:
    metadata:
      labels:
        app: rays-hermes-agent 
    spec:
      # 1. Pod-level security context to ensure volumes inherit the right group
      shareProcessNamespace: true 
      securityContext:
        fsGroup: 1000

      # 2. Define our shared bridge volumes
      volumes:
      - name: hermes-home
        persistentVolumeClaim:
          claimName: rays-hermes-agent-pvc 
      - name: hermes-agent-src
        emptyDir: {}
      - name: hermes-workspace
        emptyDir: {}
      - name: hermes-webui-app
        emptyDir: {}
      - name: rays-hermes-configmap 
        configMap:
          name: rays-hermes-config 

      initContainers:
      # 3. K8s workaround: Copy the agent source code into the shared emptyDir
      - name: copy-agent-source
        image: nousresearch/hermes-agent:latest
        command: 
        - "sh"
        - "-c"
        - |
          cp -a /opt/hermes/. /shared-src/ && chown -R 1024:1000 /shared-src /shared-home
          
          if [ -f /tmp/hermes/config.yaml ]; then
            cp -f /tmp/hermes/config.yaml /shared-home/config.yaml
          fi
          
          mkdir -p /shared-home/.local/bin
          echo '#!/bin/sh' > /shared-home/.local/bin/gh
          echo 'exit 1' >> /shared-home/.local/bin/gh
          chmod +x /shared-home/.local/bin/gh

        securityContext:
          runAsUser: 0 # Run as root briefly to copy and fix permissions
          runAsNonRoot: false
        volumeMounts:
        - name: hermes-agent-src 
          mountPath: /shared-src
        - name: hermes-home 
          mountPath: /shared-home
        - name: rays-hermes-configmap 
          mountPath: /tmp/hermes/config.yaml
          subPath: config.yaml 
      containers:
      # ==========================================
      # CONTAINER 1: HERMES AGENT
      # ==========================================
      - name: rays-hermes-agent 
        image: nousresearch/hermes-agent:latest
        args: ["gateway", "run"]
        ports:
        - containerPort: 8642
        
        env:
        - name: PATH
          value: "/home/hermes/.hermes/.local/bin:/opt/hermes/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        - name: HOME
          value: "/home/hermes/.hermes"
        - name: HERMES_HOME
          value: "/home/hermes/.hermes"
        - name: HERMES_UID
          value: "1024"
        - name: HERMES_GID
          value: "1000"
                                                                                                                     
        - name: TELEGRAM_BOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: rays-hermes-secret 
              key: TELEGRAM_BOT_TOKEN 
          
        - name: XAI_API_KEY
          valueFrom:
            secretKeyRef:
              name: xai-apikey
              key: XAI_API_KEY 
                
        - name: TELEGRAM_ALLOWED_USERS
          value: "7105451284"         

          # === Local vLLM (OpenAI-compatible) ===
        - name: OPENAI_BASE_URL
          value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1"   # ← adjust if your service name differs
          
        - name: HERMES_MODEL_PROVIDER
          value: xai
          
        - name: HERMES_MODEL 
          value: grok-4.20-0309-reasoning
          
        - name: OPENAI_API_KEY
          value: "dummy"        
 
          
        
        volumeMounts:
        - name: hermes-home 
          mountPath: /home/hermes/.hermes
        - name: hermes-agent-src
          mountPath: /opt/hermes

        securityContext:
          runAsUser: 1024
          runAsGroup: 1000
          runAsNonRoot: true
          allowPrivilegeEscalation: true

      # ==========================================
      # CONTAINER 2: HERMES WEBUI
      # ==========================================
      - name: hermes-webui
        image: ghcr.io/nesquena/hermes-webui:0.51.22
        ports:
        - containerPort: 8787
        
        env:
        - name: HOME
          value: "/home/hermeswebui/.hermes"
        - name: HERMES_HOME
          value: "/home/hermeswebui/.hermes"
        - name: HERMES_WEBUI_HOST
          value: "0.0.0.0"
        - name: HERMES_WEBUI_PORT
          value: "8787"
        - name: HERMES_WEBUI_STATE_DIR
          value: "/home/hermeswebui/.hermes/webui"
        - name: WANTED_UID
          value: "1024"
        - name: WANTED_GID
          value: "1000"
        - name: HERMES_SKIP_CHMOD
          value: "1"
          
        volumeMounts:
        - name: hermes-home  
          mountPath: /home/hermeswebui/.hermes
        # This is where the WebUI looks for the agent source code to run `uv pip install`
        - name: hermes-agent-src 
          mountPath: /home/hermeswebui/.hermes/hermes-agent
        - name: hermes-workspace
          mountPath: /workspace
        - name: hermes-webui-app
          mountPath: /app

        resources:
          requests:
            memory: 500Mi
            cpu: "100m"
          limits:
            memory: 1Gi
            cpu: "500m"

        securityContext:
          runAsUser: 1024
          runAsGroup: 1000
          runAsNonRoot: true
          allowPrivilegeEscalation: true 
          readOnlyRootFilesystem: false
          seccompProfile:
            type: RuntimeDefault 
---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: rays-hermes-agent-pvc 
  namespace: customer1
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 25Gi

---


apiVersion: v1
kind: Service
metadata:
  name: rays-hermes-webui-service 
  namespace: customer1
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: "rays-hermes-webui"
    tailscale.com/tags: "tag:k8s-operator"
    tailscale.com/ports: "http:8787"
spec:
  type: ClusterIP
  selector:
    app: rays-hermes-agent 
  ports:
    - port: 8787
      targetPort: 8787
      name: http