hermes-agent: setup pocket-id for dashboard login

[tyriis]

Hermes Dashboard — Pocket ID OIDC Integration

Overview

Add OpenID Connect authentication to the Hermes Agent web dashboard using the built-in self-hosted OIDC provider, authenticating against the existing Pocket ID instance at id.techtales.io.

Reference: Issue #9092 — "in order to adjust configurations for the agent, we want the admin user to be able to access each instance dashboard."

Approach

Use Hermes' built-in SelfHostedOIDCProvider (ships with Hermes, no external plugin). This provider verifies the OIDC ID token (which contains profile claims — name, preferred_username, email) and displays them in the dashboard UI. No supply chain risk, no extra dependencies.

Scope

All 4 Hermes instances get OIDC on their dashboard containers and an HTTPRoute for external access. Admin users authenticate via Pocket ID at hermes-agent-{user}.techtales.io.

Changes

1. Configmap — add OIDC provider (kubernetes/main/apps/hermes-agent/app/configmap.yaml)

Add the self-hosted OIDC config under the existing dashboard: section in all 4 instances (the configmap is shared via ${APP} substitution):

dashboard:
  oauth:
    provider: self-hosted
    self_hosted:
      issuer: https://id.techtales.io
      client_id: ${APP}
      # Resolves to e.g. hermes-agent-tyriis
      scopes: "openid profile email groups"
  public_url: https://${APP}.techtales.io

• public_url is required so the OAuth callback resolves to the correct external URL behind the proxy.
• client_id is parameterized per instance (${APP} = hermes-agent-tyriis, etc.).

2. Dashboard container — remove --insecure (helm-release.yaml)

Change the dashboard container args from:

args: ["dashboard", "--host", "0.0.0.0", "--insecure"]

to:

args: ["dashboard", "--host", "0.0.0.0"]

Removing --insecure engages the auth gate when the dashboard binds to a non-loopback address. The gate requires at least one registered DashboardAuthProvider. The SelfHostedOIDCProvider auto-activates when dashboard.oauth.self_hosted.issuer + client_id are configured.

3. HTTPRoute — expose dashboard (kubernetes/main/apps/hermes-agent/app/route.yaml)

Add an HTTPRoute resource (new file) to expose the dashboard on hermes-agent-{user}.techtales.io:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${APP}-dashboard
spec:
  parentRefs:
    - name: envoy
      namespace: envoy-gateway
  hostnames:
    - ${APP}.techtales.io
  rules:
    - backendRefs:
        - name: ${APP}
          port: 9119

No envoy-pocketid component here — auth is handled by the dashboard itself, not at the proxy level. Double auth (Envoy OIDC + dashboard OIDC) would provide no benefit.

4. NetworkPolicy — allow dashboard port (network-policy.yaml)

Add port 9119 (dashboard) to the ingress rules so the Envoy Gateway can reach the dashboard container:

ingress:
  - from:
      - namespaceSelector: {}
    ports:
      - protocol: TCP
        port: 9119

The existing rule for port 8642 (API server, open-webui only) stays unchanged.

5. Kustomization — register new resource (app/kustomization.yaml)

Add ./route.yaml to the resources list.

6. Pocket ID OIDC clients (MANUAL — external repo)

Owner: You (separate repo for Pocket ID config)

Instance	Client ID	Redirect URI
tyriis	hermes-agent-tyriis	https://hermes-agent-tyriis.techtales.io/auth/callback
jazzlyn	hermes-agent-jazzlyn	https://hermes-agent-jazzlyn.techtales.io/auth/callback
crowlex	hermes-agent-crowlex	https://hermes-agent-crowlex.techtales.io/auth/callback
techinik	hermes-agent-techinik	https://hermes-agent-techinik.techtales.io/auth/callback

OR 1 client with wildcard: client ID hermes-agent, redirect URI https://hermes-agent-*.techtales.io/auth/callback.

Restrict access to the admins group (or your chosen admin group) in Pocket ID.

7. ExternalSecret — add OIDC client ID (MANUAL)

Owner: You

Add HERMES_DASHBOARD_OIDC_CLIENT_ID to the ExternalSecret template for each instance. The value comes from OpenBao at infra/kubernetes/main/hermes-agent/${APP} (add a new key).

Design Decisions

Decision	Rationale
Built-in provider over community plugin	No supply chain risk, no extra deps, uses ID token (has profile claims)
Plain HTTPRoute (no envoy-pocketid)	Auth at dashboard level is sufficient; double OIDC adds complexity with no benefit
All 4 instances exposed	Each instance already has a dashboard container; OIDC handles auth

Manual Steps (for you)

• Create OIDC client(s) in Pocket ID
• Add HERMES_DASHBOARD_OIDC_CLIENT_ID to OpenBao for each instance