deploy hermes

cluster/applications/jarvis/application.yaml

@@ -0,0 +1,30 @@
+# ------------------------------------------------------------------------------
+# Application: jarvis (Hermes Agent)
+# Wave 20 — application workload, after platform services
+# Single-source: all manifests from repo
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jarvis
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+spec:
+  project: default
+  sources:
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/applications/jarvis
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: jarvis
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/applications/jarvis/deployment.yaml

@@ -0,0 +1,116 @@
+# ------------------------------------------------------------------------------
+# Hermes Agent (jarvis) — Deployment + Service + PVC
+#
+# Hermes requires a one-time interactive setup before first gateway run.
+# See bootstrap procedure below before applying for the first time.
+#
+# Bootstrap procedure (run once):
+#   1. kubectl run hermes-setup -it --rm --image=nousresearch/hermes-agent \
+#        --overrides='{"spec":{"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"jarvis-data"}}],"containers":[{"name":"hermes-setup","image":"nousresearch/hermes-agent","command":["setup"],"stdin":true,"tty":true,"volumeMounts":[{"name":"data","mountPath":"/opt/data"}]}]}}' \
+#        -n jarvis
+#   2. Complete the setup wizard:
+#      - Provider: Ollama (custom endpoint)
+#      - Base URL: http://astro-orbiter.local.mk-labs.cloud:11434/v1
+#      - API Key: none (leave blank)
+#      - Model: qwen3:8b
+#      - Messaging: skip for now
+#   3. Verify config was written: kubectl exec -n jarvis <pod> -- ls /opt/data
+#   4. Apply the rest of the manifests (ArgoCD will handle from here)
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jarvis-data
+  namespace: jarvis
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  # Uses cluster default StorageClass (Ceph/Longhorn — whatever fastpass has)
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jarvis
+  namespace: jarvis
+  labels:
+    app: jarvis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jarvis
+  template:
+    metadata:
+      labels:
+        app: jarvis
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: hermes
+          image: nousresearch/hermes-agent:latest
+          command: ["gateway", "run"]
+          ports:
+            - containerPort: 8642
+              name: gateway
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: HERMES_DASHBOARD
+              value: "1"
+            - name: API_SERVER_ENABLED
+              value: "true"
+            - name: API_SERVER_HOST
+              value: "0.0.0.0"
+            - name: API_SERVER_CORS_ORIGINS
+              value: "*"
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8642
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8642
+            initialDelaySeconds: 15
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: jarvis-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jarvis
+  namespace: jarvis
+  labels:
+    app: jarvis
+spec:
+  selector:
+    app: jarvis
+  ports:
+    - name: gateway
+      port: 8642
+      targetPort: 8642

cluster/applications/jarvis/httproute.yaml

@@ -0,0 +1,45 @@
+# ------------------------------------------------------------------------------
+# HTTPRoute — jarvis (Hermes Agent) via Cilium Gateway
+# Hostnames: jarvis.local.mk-labs.cloud
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: jarvis-tls
+  namespace: jarvis
+spec:
+  secretName: jarvis-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - jarvis.local.mk-labs.cloud
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jarvis
+  namespace: jarvis
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: jarvis.local.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/target: "10.1.71.90"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: fastpass-gateway
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - jarvis.local.mk-labs.cloud
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: jarvis
+          port: 8642
+          weight: 1