remove jarvis deployment

archive/jarvis/application.yaml

@@ -0,0 +1,30 @@
+# ------------------------------------------------------------------------------
+# Application: jarvis (Hermes Agent)
+# Wave 20 — application workload, after platform services
+# Single-source: all manifests from repo
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jarvis
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+spec:
+  project: default
+  sources:
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/applications/jarvis
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: jarvis
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

archive/jarvis/deployment.yaml

@@ -0,0 +1,111 @@
+# ------------------------------------------------------------------------------
+# Hermes Agent (jarvis) — Deployment + Service + PVC
+#
+# Bootstrap procedure (run once before first deploy):
+#   1. Create namespace and PVC, run hermes setup wizard on scrim
+#   2. kubectl cp config.yaml into jarvis-data PVC via busybox init pod
+#   3. Push manifests — ArgoCD deploys against pre-populated PVC
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jarvis-data
+  namespace: jarvis
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jarvis
+  namespace: jarvis
+  labels:
+    app: jarvis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jarvis
+  template:
+    metadata:
+      labels:
+        app: jarvis
+    spec:
+      # Running as root to work around NFS root_squash preventing UID 10000
+      # from writing to the PVC. Hermes supports root execution.
+      # PSA namespace must be set to baseline or privileged for this to work.
+      securityContext:
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: hermes
+          image: nousresearch/hermes-agent:latest
+          args: ["gateway", "run"]
+          ports:
+            - containerPort: 8642
+              name: gateway
+          securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: HERMES_DASHBOARD
+              value: "1"
+            - name: API_SERVER_ENABLED
+              value: "true"
+            - name: API_SERVER_HOST
+              value: "0.0.0.0"
+            - name: API_SERVER_CORS_ORIGINS
+              value: "*"
+            - name: HERMES_UID
+              value: "0"
+            - name: HERMES_GID
+              value: "0"
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8642
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8642
+            initialDelaySeconds: 15
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: jarvis-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jarvis
+  namespace: jarvis
+  labels:
+    app: jarvis
+spec:
+  selector:
+    app: jarvis
+  ports:
+    - name: gateway
+      port: 8642
+      targetPort: 8642

archive/jarvis/httproute.yaml

@@ -0,0 +1,45 @@
+# ------------------------------------------------------------------------------
+# HTTPRoute — jarvis (Hermes Agent) via Cilium Gateway
+# Hostnames: jarvis.local.mk-labs.cloud
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: jarvis-tls
+  namespace: jarvis
+spec:
+  secretName: jarvis-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - jarvis.local.mk-labs.cloud
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jarvis
+  namespace: jarvis
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: jarvis.local.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/target: "10.1.71.90"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: fastpass-gateway
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - jarvis.local.mk-labs.cloud
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: jarvis
+          port: 8642
+          weight: 1

archive/jarvis/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jarvis
+  labels:
+    # baseline PSA required — Hermes runs as root due to NFS root_squash
+    # preventing UID 10000 from writing to nfs-emporium PVC.
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: baseline