Add hermes-dashboard service + ingress with OAuth2 SSO for bot.junv.cc

home-apps/hermes-dashboard.yaml

@@ -0,0 +1,64 @@
+# Expose Hermes Agent Web Dashboard at bot.junv.cc with OAuth2 SSO
+# Dashboard runs on server-3 (192.168.1.2:9119) via hermes-dashboard.service
+#
+# Deploy: kubectl apply -f home-apps/hermes-dashboard.yaml
+# Check:  kubectl get ingress,svc,endpointslices -n home-apps hermes-dashboard
+#
+---
+# Service without selector (points to external hermes-dashboard.service on the node)
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-dashboard
+  namespace: home-apps
+spec:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 9119
+    protocol: TCP
+---
+# EndpointSlice pointing to the dashboard process on server-3
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: hermes-dashboard
+  namespace: home-apps
+  labels:
+    kubernetes.io/service-name: hermes-dashboard
+addressType: IPv4
+endpoints:
+  - addresses:
+      - 192.168.1.2
+ports:
+  - name: http
+    port: 9119
+    protocol: TCP
+---
+# Ingress with OAuth2 SSO protection
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes-dashboard-ingress
+  namespace: home-apps
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - bot.junv.cc
+    secretName: hermes-dashboard-tls
+  rules:
+  - host: bot.junv.cc
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: hermes-dashboard
+            port:
+              number: 80