Files

kubernetes/apps/ai/hermes-matrix/app/helmrelease.yaml

1 ---

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json

3 apiVersion: helm.toolkit.fluxcd.io/v2

4 kind: HelmRelease

5 metadata:

6 name: hermes-matrix

7 spec:

8 chartRef:

9 kind: OCIRepository

10 name: hermes-matrix

11 interval: 1h

12 values:

13 defaultPodOptions:

14 securityContext:

15 fsGroup: 65534

16 fsGroupChangePolicy: OnRootMismatch

17 runAsGroup: 65534

18 runAsNonRoot: true

19 runAsUser: 65534

20 seccompProfile:

21 type: RuntimeDefault

22 controllers:

23 hermes-matrix:

24 annotations:

25 reloader.stakater.com/auto: "true"

26 replicas: 1

27 strategy: Recreate

28 type: deployment

29 initContainers:

30 patch-matrix:

31 image:

32 repository: registry.erwanleboucher.dev/eleboucher/hermes-matrix

33 tag: 0.15.2-33e1668

34 command:

35 - sh

36 - -c

37 - |

38 set -eu

39 python3 /run/config/patch-matrix.py \

40 /usr/local/lib/python3.12/site-packages/gateway/platforms/matrix.py \

41 /patched/matrix.py

42 cp /run/secret/config.yaml /data/config.yaml

43 chmod 600 /data/config.yaml

44 securityContext:

45 allowPrivilegeEscalation: false

46 capabilities:

47 drop:

48 - ALL

49 containers:

50 app:

51 image:

52 repository: registry.erwanleboucher.dev/eleboucher/hermes-matrix

53 tag: 0.15.2-33e1668

54 env:

55 HERMES_HOME: /data

56 MATRIX_ENCRYPTION: "true"

57 GATEWAY_PROXY_URL: http://hermes.ai.svc.cluster.local:8642

58 envFrom:

59 - secretRef:

60 name: hermes-matrix

61 resources:

62 requests:

63 cpu: 25m

64 memory: 256Mi

65 limits:

66 memory: 1Gi

67 securityContext:

68 allowPrivilegeEscalation: false

69 capabilities:

70 drop:

71 - ALL

72 persistence:

73 data:

74 existingClaim: hermes-matrix

75 advancedMounts:

76 hermes-matrix:

77 patch-matrix:

78 - path: /data

79 app:

80 - path: /data

81 patched:

82 type: emptyDir

83 advancedMounts:

84 hermes-matrix:

85 patch-matrix:

86 - path: /patched

87 app:

88 - path: /usr/local/lib/python3.12/site-packages/gateway/platforms/matrix.py

89 subPath: matrix.py

90 config:

91 type: configMap

92 name: hermes-matrix-configmap

93 advancedMounts:

94 hermes-matrix:

95 patch-matrix:

96 - path: /run/config

97 config-secret:

98 type: secret

99 name: hermes-matrix-config

100 defaultMode: 0o400

101 advancedMounts:

102 hermes-matrix:

103 patch-matrix:

104 - path: /run/secret

105 tmp:

106 type: emptyDir

107 globalMounts:

108 - path: /tmp

replicas 1 with Recreate keeps Matrix crypto store single-writer

invariant ·ok L27

Both halves are load-bearing and neither is a default worth "tidying up". Two Matrix clients sharing one account and one crypto store clash over device identity, so a second replica — or a RollingUpdate that briefly runs two pods — breaks encryption for the bot rather than scaling it.

2026-08-0401KZ6M4J2FQ2AYS47YEZE09N2Y

patch-matrix image patches matrix.py into the bot base image

gotcha ·ok L30

THIS DEPLOYMENT RUNS A PATCHED gateway/platforms/matrix.py. The upstream image is hermes v0.15.2 (2026.5.29.2) and never wires per-channel prompts into MessageEvent for Matrix, though Telegram and Slack get them. Everything else the feature needs is already in the image, so the patch touches only the two MessageEvent constructions. Full rationale and the removal condition are recorded on the patch-matrix.py key in configmap.yaml.

Show the rest

The patch is anchored and fails closed: if a base-image bump reshapes those blocks this container exits non-zero and the pod stays down, rather than quietly reverting every room to a single shared persona. A pod stuck in Init after a tag bump is the expected signal, not a mystery — re-derive the patch.

2026-08-0401KZ6M4PMKQGNVWE66SXXBWEXX

config.yaml is copied onto the PVC for HERMES_HOME consumption

why ·ok L42

The per-room personas are rendered with the private room IDs by the hermes-matrix-config ExternalSecret, and have to be copied onto the PVC because the proxy reads config.yaml from HERMES_HOME (/data), not from a mounted secret path. Mounting the secret at /data directly is not an option — it would shadow the rest of the PVC.

2026-08-0401KZ6M4RKKTKB3AHZSAC98HKAE

hermes-matrix forwards into the main hermes API server

why ·ok L57

This deployment is a proxy, not a second agent: it terminates Matrix encryption and forwards the decrypted text to the main hermes API server, which does the actual work.

The secret is pulled in whole rather than key-by-key because the room IDs are private. MATRIX_HOME_ROOM arrives that way and resolves to the dedicated Notify room, so no room ID ever appears in this manifest.

2026-08-0401KZ6M4XBQ2NYACZKV4JJ7Z7NK

patched volume mounts app-only so the init reads pristine upstream

why ·ok L81

Holds the patched matrix.py that the init container produces. It is mounted over the site-packages copy for the app container ONLY — the init container needs the pristine upstream file at that path to read from, so mounting it for both would make the patch read its own output.

The other three volumes split by secrecy: `config` is the ConfigMap, which carries the patch script and the persona template with {{ }} placeholders and no real room IDs, so it stays in git; `config-secret` is the ExternalSecret-rendered config.yaml with the private room IDs substituted in.

2026-08-0401KZ6M4ZHH2NRV5RHA6VVJ8SBP