hermes-agent 1.3.0 (in place): drop dead WEBHOOK_URL knob, document custom-domain webhooks - #537
Merged
Merged
Conversation
…omain webhooks WEBHOOK_URL is a dead env (the image reads it 0 times), so its chart wiring and the webhooks.publicUrl knob that drove it did nothing — both removed. The displayed webhook URL comes from platforms.webhook.extra.host, which is also the listener's bind address, so there is no safe in-chart override; documented as an upstream cosmetic bug. Added the proven custom-domain coexistence path (a cpln domain routing 443 -> :8644) as the recommended way to keep the dashboard/API public on the canonical endpoint AND accept external HTTPS webhooks at the same time, with the domain manifest and DNS records. Revised 1.3.0 in place (no users yet); briefing updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Review caught the section lead-in still saying 'two ways to expose' above a three-row table (custom-domain path was added but the intro wasn't updated), contradicting two other spots that already said three. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… values comment Per maintainer: make the custom-domain webhook config very detailed in the README (now numbered steps 1-6 with a signed-request verification example) and reduce the values.yaml webhooks comment to a single line stating the option. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…rks identically at the real domain Maintainer confirmation request: verified the UI-created 'myui' subscription (dialog shows http://localhost:8644/webhooks/myui) returns 202 to a signed POST at https://<domain>/webhooks/myui and 401 to a bad sig. The displayed host is a cosmetic label; only the path matters. Note now says so explicitly and gives the substitution rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…/dashboard docs - Remove webhooks.directLoadBalancer entirely (values, workload loadBalancer.direct block, validation guard, README exposure table) — plain-HTTP, billed, and shadows the canonical; strictly worse than expose:webhooks or a custom domain - README: stop advertising cpln port-forward for the dashboard (connection-pool wedge); supported access is the public canonical endpoint, private installs are internal-only - README: fold webhook-secret into the prerequisite create-dictionary snippet; add custom-domain prerequisite bullet; note GET / on the webhook domain is 404 by design; add WhatsApp-unsupported note to Messaging platforms; note API-internal (expose:webhooks) is a valid, safer posture - briefings: record the directLoadBalancer removal (finding retained as the reason) - Chart.yaml lastModified 2026-09-03; version stays 1.3.0 (in-place, no users) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jacobecox
added a commit
that referenced
this pull request
Sep 3, 2026
* CHANGELOG: hermes-agent 1.3.0 The 1.3.0 version (PRs #536, #537) merged without its ship-close CHANGELOG entry. Add it: optional Chromium browser sidecar, external webhooks, the publicAccess.expose default flip to dashboard, and dashboard.publicUrl. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * CHANGELOG: hermes-agent 1.4.0 Add the 1.4.0 line (opt-in personal WhatsApp + pre-registered cpln MCP) above 1.3.0, on the same catalog-changelog PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In-place revision of the just-merged 1.3.0 (no users yet — maintainer ruling, precedent cpln-advisor), driven by a live spike of the "dashboard public + external HTTPS webhooks, together" question.
What changed
WEBHOOK_URLenv +webhooks.publicUrlknob. Measured: the image readsWEBHOOK_URLzero times — the wiring did nothing while implying it set the advertised URL.WEBHOOK_ENABLED/PORT/SECRETare untouched;dashboard.publicUrl(a real, working knob) is untouched.cpln domainrouting443 → container port 8644(dnsMode: cname,certChallengeType: http01, routeport: 8644) is an independent public front from the canonical endpoint. Proven live: dashboard stayed HTTPS-200 on the canonical while a signed webhook tohttps://webhooks.testsdomain.uk/webhooks/<name>returned 200 (bad sig 401), real Let's Encrypt cert. The README carries the exact manifest + DNS records as a user prerequisite.http://localhost:8644/...regardless of exposure (upstream cosmetic bug — the app ignores any public-URL setting, andplatforms.webhook.extra.hostdoubles as the listener bind address so it can't be overridden safely); anddirectLoadBalancertakes over the canonical endpoint (already noted, kept).Why the shape
One workload has one canonical public front —
exposepicks dashboard/api/webhooks, anddirectLoadBalancerreplaces the canonical with a plain-HTTP L4 endpoint. The only way to expose the dashboard AND external HTTPS webhooks simultaneously is a custom domain routing to the webhook port — verified, and now the documented recommendation.Testing
Review: PASS WITH WARNINGS; the one warning (a "two ways" lead-in above a three-row table) is fixed in this branch. Dead-knob removal confirmed clean (0
WEBHOOK_URL, no dangling refs); custom-domain manifest verified technically accurate; renders clean on all webhook arms; lint FAIL-free. The external-webhook-over-custom-domain behavior was proven end-to-end during the spike.🤖 Generated with Claude Code