Frank
9bfa0be85d
- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap runbooks etc.) now tracked. - Removed superseded skills: omp_harness_config, peon_ping_integration (replaced by user-authored peon-ping-* managed skills), rocmfp4-strix-benchmark-orchestration. - New memory-root skills: niri_compositor_ops, omp_git_workflow, omp_model_config, quadlet-media-migration, homelab-service-triage, hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.
2.2 KiB
2.2 KiB
name, description
| name | description |
|---|---|
| hermes-webui-secret-rotation | Rotate the Hermex (hermes-webui) password on Dankclaw and verify auth behaviorally — covers the dual EnvironmentFile gotcha where only dankclaw/.env is effective at container create. |
Hermex webui secret rotation (Dankclaw)
Auth contract (verified live 2026-08-31): POST /api/auth/login with JSON {"password":"..."} → 200 + signed HttpOnly hermes_session cookie (24 h TTL) on match, 401 on miss. No username field. /health answers 200 unauthenticated and / answers 302 — never verify auth via those; always probe login with a deliberately wrong password (expect 401) and the real one (expect 200).
Rotation procedure
ssh -o BatchMode=yes dankclaw 'bash -s'with a stdin script (zsh on the host mangles inline${...}even inside single-quoted ssh args — never interpolate curl-w %{http_code}inline; pipe the whole probe as a heredoc'd bash script).- Update BOTH env files with
sed -i "s/^HERMES_WEBUI_PASSWORD=.*/HERMES_WEBUI_PASSWORD=<new>/":/home/dank/serverAppConfigs/.env([Service] EnvironmentFile)/home/dank/serverAppConfigs/dankclaw/.env— the effective one: the quadlet unit's[Container] EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.envis what the container reads at create; rotating only the root file leaves the running container serving the old secret.
systemctl --user restart hermes-webui.service(unit recreation re-reads env; no deploy needed if the unit file itself didn't change).- Verify: wrong-pw login → 401, right-pw → 200, from both host loopback and a LAN client at
http://192.168.0.143:8787(webui publishes on the LAN interface since commit 4443897; off-network ingress is SSH tunnel only — usertunnel, port 22, key-only auth, forward remote end localhost:8787).
Gotchas
sudo podman execfails exit 125 here: root's namespace does not see rootless containers — runpodman exec hermes-webui printenv HERMES_WEBUI_PASSWORDunprivileged (ssh user owns the env files, mode 600).- If rotating because a secret leaked into transcripts/logs, rotate in place via a script that fetches the live value from the running container (
printenv) instead of transcribing it.