From bf1bf4d9b9520b5d98409b1136a514ceb65e693d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E9=BB=91=20=28AI=20Bot=29?= <ai-bot@openclaw.ai>
Date: Tue, 14 Apr 2026 11:08:56 +1000
Subject: [PATCH] Add hermes-dashboard service + ingress with OAuth2 SSO for
 bot.junv.cc

---
 home-apps/hermes-dashboard.yaml | 64 +++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 home-apps/hermes-dashboard.yaml

diff --git a/home-apps/hermes-dashboard.yaml b/home-apps/hermes-dashboard.yaml
new file mode 100644
index 0000000..d265592
--- /dev/null
+++ b/home-apps/hermes-dashboard.yaml
@@ -0,0 +1,64 @@
+# Expose Hermes Agent Web Dashboard at bot.junv.cc with OAuth2 SSO
+# Dashboard runs on server-3 (192.168.1.2:9119) via hermes-dashboard.service
+#
+# Deploy: kubectl apply -f home-apps/hermes-dashboard.yaml
+# Check:  kubectl get ingress,svc,endpointslices -n home-apps hermes-dashboard
+#
+---
+# Service without selector (points to external hermes-dashboard.service on the node)
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-dashboard
+  namespace: home-apps
+spec:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 9119
+    protocol: TCP
+---
+# EndpointSlice pointing to the dashboard process on server-3
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: hermes-dashboard
+  namespace: home-apps
+  labels:
+    kubernetes.io/service-name: hermes-dashboard
+addressType: IPv4
+endpoints:
+  - addresses:
+      - 192.168.1.2
+ports:
+  - name: http
+    port: 9119
+    protocol: TCP
+---
+# Ingress with OAuth2 SSO protection
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hermes-dashboard-ingress
+  namespace: home-apps
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - bot.junv.cc
+    secretName: hermes-dashboard-tls
+  rules:
+  - host: bot.junv.cc
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: hermes-dashboard
+            port:
+              number: 80