# ------------------------------------------------------------------------------
# Hermes Agent (jarvis) — Deployment + Service + PVC
#
# Hermes requires a one-time interactive setup before first gateway run.
# See bootstrap procedure below before applying for the first time.
#
# Bootstrap procedure (run once):
#   1. kubectl run hermes-setup -it --rm --image=nousresearch/hermes-agent \
#        --overrides='{"spec":{"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"jarvis-data"}}],"containers":[{"name":"hermes-setup","image":"nousresearch/hermes-agent","command":["setup"],"stdin":true,"tty":true,"volumeMounts":[{"name":"data","mountPath":"/opt/data"}]}]}}' \
#        -n jarvis
#   2. Complete the setup wizard:
#      - Provider: Ollama (custom endpoint)
#      - Base URL: http://astro-orbiter.local.mk-labs.cloud:11434/v1
#      - API Key: none (leave blank)
#      - Model: qwen3:8b
#      - Messaging: skip for now
#   3. Verify config was written: kubectl exec -n jarvis <pod> -- ls /opt/data
#   4. Apply the rest of the manifests (ArgoCD will handle from here)
# ------------------------------------------------------------------------------
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jarvis-data
  namespace: jarvis
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  # Uses cluster default StorageClass (Ceph/Longhorn — whatever fastpass has)
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jarvis
  namespace: jarvis
  labels:
    app: jarvis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jarvis
  template:
    metadata:
      labels:
        app: jarvis
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: hermes
          image: nousresearch/hermes-agent:latest
          command: ["gateway", "run"]
          ports:
            - containerPort: 8642
              name: gateway
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          env:
            - name: HERMES_DASHBOARD
              value: "1"
            - name: API_SERVER_ENABLED
              value: "true"
            - name: API_SERVER_HOST
              value: "0.0.0.0"
            - name: API_SERVER_CORS_ORIGINS
              value: "*"
          volumeMounts:
            - name: data
              mountPath: /opt/data
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8642
            initialDelaySeconds: 30
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health
              port: 8642
            initialDelaySeconds: 15
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: jarvis-data
---
apiVersion: v1
kind: Service
metadata:
  name: jarvis
  namespace: jarvis
  labels:
    app: jarvis
spec:
  selector:
    app: jarvis
  ports:
    - name: gateway
      port: 8642
      targetPort: 8642