hermes-agent 1.3.0 (in place): drop dead WEBHOOK_URL knob, document custom-domain webhooks

briefings/hermes-agent.md

@@ -21,7 +21,7 @@
 - Single replica by design (SQLite single-writer; upstream forbids two gateways on one data dir)
 - User creates a dictionary secret (their own key names, mapped via `secret.keys`): LLM key, API bearer token (≥16 chars), dashboard password
 
-**Key knobs:** `model.{provider(anthropic|openai|custom),name,baseUrl,reasoningEffort}` · `secret.{name,keys(apiKey,apiServerKey,dashboardPassword,webhookSecret)}` · `dashboard.{enabled,username,publicUrl(1.3.0)}` · `browser.{enabled(1.3.0,default false),image,cdpPort,resources}` · `webhooks.{enabled(1.3.0),publicUrl,directLoadBalancer.enabled}` · `publicAccess.{enabled (default **false**), expose (api|dashboard|webhooks; default **dashboard** as of 1.3.0)}` · volumeset autoscaling
+**Key knobs:** `model.{provider(anthropic|openai|custom),name,baseUrl,reasoningEffort}` · `secret.{name,keys(apiKey,apiServerKey,dashboardPassword,webhookSecret)}` · `dashboard.{enabled,username,publicUrl(1.3.0)}` · `browser.{enabled(1.3.0,default false),image,cdpPort,resources}` · `webhooks.{enabled(1.3.0)}` · `publicAccess.{enabled (default **false**), expose (api|dashboard|webhooks; default **dashboard** as of 1.3.0)}` · volumeset autoscaling
 
 **Troubleshooting / considerations**
 - **Public install = internet-facing terminal-capable agent behind ONE bearer token** — that's why `publicAccess` defaults false; insist on long random keys
@@ -61,3 +61,14 @@
 - **No-code channel findings (README truth pass, no code):** Telegram works out of the box (BotFather token). Slack has two traps — its app manifest caps at **25 slash commands** but Hermes emits ~50 (trim before creating the app or Slack rejects it), and Slack's user allowlist **fails CLOSED when empty** (silently rejects everyone — must set allowed users). A connected chat platform / OAuth'd MCP server acts AS the person who paired/authenticated it.
 - **Drift gate PASSED (live, 2-container install):** first no-op `helm upgrade` reported workload/identity/policy `Unchanged` and only the volumeset `Updated` (the documented first-upgrade re-apply; volumeset.yaml is byte-identical to 1.2.1); second no-op upgrade was fully `Unchanged`. The sidecar container + new env + reordered ports introduced NO new drift.
 - **Sidecar image sourcing:** `chromedp/headless-shell` stable tag moves daily; `151.0.7922.109` was current stable at build (== `stable`/`latest`, 2026-08-11). Re-confirm the exact tag exists on `docker.io/chromedp/headless-shell` when bumping. `appVersion` stays `2026.8.31` (the Nous app image; the sidecar is a separate `image:` knob, not the primary workload image).
+
+**1.3.0 in-place webhook-URL fix (2026-09-02, all measured live; revised in place — no users yet):**
+- **`WEBHOOK_URL` is a DEAD env — the image reads it 0 times** (`grep -rn getenv WEBHOOK_URL` = 0; only per-platform envs like `TELEGRAM_WEBHOOK_URL` exist). The chart's `WEBHOOK_URL` wiring did nothing, so it (and the `webhooks.publicUrl` knob that drove it) is **REMOVED**. Remaining webhook env is `WEBHOOK_ENABLED` / `WEBHOOK_PORT` / `WEBHOOK_SECRET` only.
+- **The displayed webhook URL comes from `platforms.webhook.extra.host`, which is DUAL-PURPOSE: it is BOTH the display host AND the listener's bind address.** Setting it to a public hostname makes the listener fail to bind (`Could not bind <host>:8644`) → no listener → 503. **The chart must NEVER set `extra.host`.** There is no chart-config way to make the dashboard/CLI display the correct public URL — it always shows `http://localhost:8644`. Upstream cosmetic bug; documented in the README, not fixed in-chart.
+- **Custom-domain path is the PROVEN coexistence solution (verified live on testsdomain.uk).** A `cpln domain` routing `443 → :8644` (route `port: 8644`, `dnsMode: cname`, `certChallengeType: http01`) is an INDEPENDENT public front from the canonical endpoint: dashboard stayed 200 on the canonical HTTPS endpoint WHILE a signed webhook to `https://webhooks.testsdomain.uk/webhooks/<name>` returned 200 (bad sig 401), real Let's Encrypt cert. This is the ONLY way to have dashboard public AND external HTTPS webhooks simultaneously. Documented as a prerequisite (chart can't own DNS). README carries the domain manifest shape + DNS records (ownership TXT `_cpln-<label>` = org name; CNAME `<label> → <gvcAlias>.cpln.app`).
+- **`directLoadBalancer` does NOT coexist** with a public canonical surface — enabling it flips `status.canonicalEndpoint` to `tcp://…:8644` and the dashboard HTTPS goes 503.
+
+**1.3.0 in-place feedback batch (2026-09-03, revised in place — no users yet):**
+- **`webhooks.directLoadBalancer` REMOVED entirely** (maintainer ruling). It was strictly worse than both surviving paths (`publicAccess.expose: webhooks` and a custom domain): plain-HTTP/L4 so HTTPS-only providers reject it, billed continuously whether or not events arrive, and it takes over the canonical endpoint (the finding above — directLB shadows the canonical, flipping `status.canonicalEndpoint` to `tcp://…:8644` — stays recorded as the reason it was cut). Gone from values (`webhooks:` now has only `enabled`), workload (`loadBalancer.direct` block deleted), the validation guard, and the README (exposure table down to 2 rows). Webhooks now expose two ways, both HTTPS.
+- **Dashboard-via-`cpln port-forward` no longer advertised in the README** (maintainer ruling — browser traffic through the tunnel wedges on the connection-pool bug). Supported dashboard access is the public canonical endpoint (`expose: dashboard`); a private install's dashboard is simply internal-only.
+- README also: webhook-secret folded into the prerequisite `create-dictionary` snippet; custom-domain prerequisite bullet added; `GET /` on the webhook domain returns 404 by design (routes to listener, only serves `/webhooks/<name>`); WhatsApp-unsupported note added to Messaging platforms (alongside the existing Important-Notes bullet); note that keeping the API internal (`expose: webhooks`) is a valid, safer posture.

hermes-agent/versions/1.3.0/Chart.yaml

@@ -12,6 +12,6 @@ dependencies:
 
 annotations:
   created: "2026-07-15"
-  lastModified: "2026-09-02"
+  lastModified: "2026-09-03"
   category: "ai"
   createsGvc: false