# ------------------------------------------------------------------------------
# Hermes Agent (jarvis) — Deployment + Service + PVC
#
# Bootstrap procedure (run once before first deploy):
#   1. Create namespace and PVC, run hermes setup wizard on scrim
#   2. kubectl cp config.yaml into jarvis-data PVC via busybox init pod
#   3. Push manifests — ArgoCD deploys against pre-populated PVC
# ------------------------------------------------------------------------------
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jarvis-data
  namespace: jarvis
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jarvis
  namespace: jarvis
  labels:
    app: jarvis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jarvis
  template:
    metadata:
      labels:
        app: jarvis
    spec:
      # Running as root to work around NFS root_squash preventing UID 10000
      # from writing to the PVC. Hermes supports root execution.
      # PSA namespace must be set to baseline or privileged for this to work.
      securityContext:
        runAsUser: 0
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: hermes
          image: nousresearch/hermes-agent:latest
          args: ["gateway", "run"]
          ports:
            - containerPort: 8642
              name: gateway
          securityContext:
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          env:
            - name: HERMES_DASHBOARD
              value: "1"
            - name: API_SERVER_ENABLED
              value: "true"
            - name: API_SERVER_HOST
              value: "0.0.0.0"
            - name: API_SERVER_CORS_ORIGINS
              value: "*"
            - name: HERMES_UID
              value: "0"
            - name: HERMES_GID
              value: "0"
          volumeMounts:
            - name: data
              mountPath: /opt/data
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8642
            initialDelaySeconds: 30
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health
              port: 8642
            initialDelaySeconds: 15
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: jarvis-data
---
apiVersion: v1
kind: Service
metadata:
  name: jarvis
  namespace: jarvis
  labels:
    app: jarvis
spec:
  selector:
    app: jarvis
  ports:
    - name: gateway
      port: 8642
      targetPort: 8642