Frank
aaa1f82313
Two things, found while checking whether the hermes trio still needed migrating. 1. **The phone-facing webui was exposed to the LAN.** Its unit runs with Network=host, so there is no Podman port forwarder and the app's own bind is the exposure. The compose service it replaced published `127.0.0.1:8787:8787` (loopback); the unit bound `HERMES_WEBUI_HOST=0.0.0.0`, and the LAN address answered 200 — password-gated, but on every interface, which is not the documented "SSH tunnel is the sole ingress" posture. It now binds 127.0.0.1, which serves the tunnel just as well (sshd dials localhost:8787 from the host). The unit comment claiming "LAN-facing as before" was wrong about "before", and is corrected. 2. **Dankclaw's compose.yaml is retired.** Auditing ownership showed every running container on that host reports a PODMAN_SYSTEMD_UNIT label — the hermes trio's units have owned their containers since 2026-09-12 — so the three service blocks left in compose.yaml were dead weight that could only create a duplicate container fighting a unit for a name. deploy_hermes was already fully unit-based. The file is staged in .AGENTTRASH/; the planner plans nothing for it, an unknown service on that target now errors instead of silently no-oping through `podman-compose`, and DANKCLAW_COMPOSE_SERVICES is empty. The hermes-webui seam now reads the unit — it read compose, which is exactly how the bind drifted while the test kept passing against a file nobody ran.
103 lines
4.7 KiB
Bash
103 lines
4.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Seam: hermes-webui (the Hermex server) deployment integrity.
|
|
# The webui is the phone-facing API for the Hermes agent. It must stay
|
|
# loopback-bound so the SSH tunnel is its only ingress, keep its password in
|
|
# the host .env, and share the gateway data volume.
|
|
#
|
|
# It reads the QUADLET UNIT, which is the live source of truth. It used to read
|
|
# dankclaw/compose.yaml, and that is exactly how the bind drifted: the compose
|
|
# service published 127.0.0.1:8787:8787 (loopback), the unit that replaced it
|
|
# bound 0.0.0.0 with only the password in front, and the test kept passing
|
|
# because it was checking the file nobody ran any more.
|
|
|
|
load helpers
|
|
|
|
UNIT="$REPO_ROOT/dankclaw/hermes/quadlet/hermes-webui.container"
|
|
ENV_EXAMPLE="$REPO_ROOT/dankclaw/.env.example"
|
|
PLANNER="$REPO_ROOT/scripts/deploy-plan.py"
|
|
DEPLOY="$REPO_ROOT/scripts/deploy.sh"
|
|
REMOTE_DEPLOY="$REPO_ROOT/scripts/deploy-remote.sh"
|
|
|
|
webui_service_yaml() {
|
|
# Normalize the unit's key=value lines into the same shape the assertions
|
|
# below always used, so the contract reads the same as it did for compose.
|
|
[ -f "$UNIT" ] || { echo "missing $UNIT" >&2; return 1; }
|
|
grep -E '^(Image|Exec|Environment|Volume|HealthCmd|PublishPort)=' "$UNIT"
|
|
}
|
|
|
|
@test "hermes-webui runs the webui bootstrap in foreground mode" {
|
|
local y
|
|
y=$(webui_service_yaml)
|
|
# The unit runs the localhost-aliased tag (this host's quadlet path cannot
|
|
# resolve registry-prefixed refs from local storage); the deployer tags it
|
|
# from the upstream name, which is what keeps the alias fresh.
|
|
grep -q 'Image=localhost/hermes-agent:latest' <<< "$y"
|
|
grep -q 'podman tag docker.io/nousresearch/hermes-agent:latest localhost/hermes-agent:latest' \
|
|
"$REPO_ROOT/scripts/deploy-remote.sh"
|
|
grep -q 'bootstrap.py' <<< "$y"
|
|
grep -q -- '--foreground' <<< "$y"
|
|
}
|
|
|
|
@test "hermes-webui binds loopback, not the LAN" {
|
|
local y
|
|
y=$(webui_service_yaml)
|
|
grep -q 'HERMES_WEBUI_PASSWORD' <<< "$y" \
|
|
|| { echo "password gate missing"; return 1; }
|
|
# With Network=host there is no port forwarder: the app's own bind IS the
|
|
# exposure. The compose service this replaced published 127.0.0.1:8787:8787,
|
|
# and an early version of the unit bound 0.0.0.0 instead — which answered
|
|
# 200 on 192.168.0.143:8787 for anyone on the LAN (measured 2026-09-16).
|
|
grep -q 'Environment=HERMES_WEBUI_HOST=127.0.0.1' <<< "$y" \
|
|
|| { echo "webui must bind loopback (HERMES_WEBUI_HOST=127.0.0.1)"; return 1; }
|
|
! grep -q 'HERMES_WEBUI_HOST=0.0.0.0' <<< "$y" \
|
|
|| { echo "webui must not bind 0.0.0.0 on a host network"; return 1; }
|
|
}
|
|
|
|
@test "hermes-webui shares the gateway data volume and mounts the webui checkout" {
|
|
local y
|
|
y=$(webui_service_yaml)
|
|
grep -q 'Environment=HERMES_HOME=/data' <<< "$y"
|
|
grep -q 'Volume=/home/dank/Containers/hermes/data:/data' <<< "$y"
|
|
grep -q 'Volume=/home/dank/Containers/hermes/webui:/webui' <<< "$y"
|
|
}
|
|
|
|
@test "hermes-webui has a healthcheck that probes /health" {
|
|
local y
|
|
y=$(webui_service_yaml)
|
|
grep -q 'HealthCmd=' <<< "$y"
|
|
grep -q '/health' <<< "$y"
|
|
}
|
|
|
|
@test "dankclaw .env.example defines the webui password placeholder" {
|
|
env_vars_defined "$ENV_EXAMPLE" | grep -qx 'HERMES_WEBUI_PASSWORD'
|
|
}
|
|
|
|
@test "planner maps a hermes-webui unit edit to the hermes service" {
|
|
# Any file under dankclaw/hermes/** selects the `hermes` service, because
|
|
# the trio (gateway, dashboard, webui) deploys as one unit-set — see
|
|
# deploy_hermes, which installs all three units and restarts them together.
|
|
# The three names are aliases of that handler, not separate deployments.
|
|
# (This test used to assert that a *compose* edit narrowed to hermes-webui;
|
|
# Dankclaw has had no compose file since 2026-09-16.)
|
|
run python3 "$PLANNER" --target dankclaw \
|
|
--paths dankclaw/hermes/quadlet/hermes-webui.container
|
|
[ "$status" -eq 0 ]
|
|
[ "$output" = "hermes" ]
|
|
# And an unrelated service must not be dragged in.
|
|
! grep -qE 'caddy|prometheus|frank-large' <<< "$output"
|
|
}
|
|
|
|
@test "remote deployer accepts and dispatches hermes-webui" {
|
|
grep -q 'dankclaw:hermes-webui' "$REMOTE_DEPLOY"
|
|
# Dispatched to the unit handler, never to compose: deploy_hermes installs
|
|
# the quadlets and retires compose-era containers.
|
|
grep -q 'hermes|hermes-dashboard|hermes-webui) deploy_hermes' "$REMOTE_DEPLOY"
|
|
# deploy_hermes installs the trio with one loop over the unit names.
|
|
grep -q 'for unit in hermes hermes-dashboard hermes-webui' "$REMOTE_DEPLOY"
|
|
grep -q 'dankclaw/hermes/quadlet/$unit.container' "$REMOTE_DEPLOY"
|
|
}
|
|
|
|
@test "top-level deployer accepts hermes-webui as a Dankclaw service" {
|
|
grep -q 'dankclaw:hermes-webui' "$DEPLOY"
|
|
}
|