mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-24 10:52:21 +00:00
eb51c180e6
The s6 dashboard entrypoint and docker integration tests relied on HERMES_DASHBOARD_INSECURE=1 to bring up a 0.0.0.0 dashboard with no auth provider. With --insecure now a no-op (auth gate mandatory on non-loopback binds), that path fails closed. - s6 dashboard/run: drop --insecure derivation; warn that the env is a no-op and point operators at HERMES_DASHBOARD_BASIC_AUTH_* / OAuth. - docker tests: supervision tests now register the bundled basic password provider (HERMES_DASHBOARD_BASIC_AUTH_USERNAME/_PASSWORD) so the gate has a provider and the dashboard binds. Rewrote the insecure-opt-out test to assert fail-closed (dashboard does NOT serve) instead of gate-bypass. - docs (en + zh-Hans): HERMES_DASHBOARD_INSECURE documented as deprecated no-op; basic-auth is the zero-infra way to authenticate a containerized public dashboard.
56 lines
2.5 KiB
Text
Executable file
56 lines
2.5 KiB
Text
Executable file
#!/command/with-contenv sh
|
|
# shellcheck shell=sh
|
|
# Dashboard service. Always declared so s6 has a supervised slot; if
|
|
# HERMES_DASHBOARD isn't truthy the run script exits cleanly and the
|
|
# companion finish script returns 125 (s6's "permanent failure, do
|
|
# not restart" marker), so s6-svstat reports the slot as down. See
|
|
# also docker/s6-rc.d/dashboard/finish.
|
|
|
|
case "${HERMES_DASHBOARD:-}" in
|
|
1|true|TRUE|True|yes|YES|Yes) ;;
|
|
*)
|
|
# Exit 0; the finish script will exit 125 → s6-supervise won't
|
|
# restart us and the slot reports down. Using a clean exit
|
|
# (rather than `exec sleep infinity`) means s6-svstat reflects
|
|
# reality: when HERMES_DASHBOARD is unset, the service is NOT
|
|
# running, just supervised-with-permanent-failure. See PR
|
|
# #30136 review item I3.
|
|
exit 0
|
|
;;
|
|
esac
|
|
|
|
# with-contenv repopulates HOME from /init as /root. Reset it before
|
|
# dropping privileges so HOME-anchored state lands under /opt/data.
|
|
export HOME=/opt/data
|
|
|
|
cd /opt/data
|
|
# shellcheck disable=SC1091
|
|
. /opt/hermes/.venv/bin/activate
|
|
|
|
dash_host="${HERMES_DASHBOARD_HOST:-0.0.0.0}"
|
|
dash_port="${HERMES_DASHBOARD_PORT:-9119}"
|
|
|
|
# The dashboard's auth gate engages automatically on non-loopback binds and
|
|
# REQUIRES a DashboardAuthProvider to be registered, else start_server fails
|
|
# closed. Two zero-infra ways to satisfy it in a container:
|
|
# • Password: set HERMES_DASHBOARD_BASIC_AUTH_USERNAME + _PASSWORD (bundled
|
|
# dashboard_auth/basic provider — no external IDP).
|
|
# • OAuth: set HERMES_DASHBOARD_OAUTH_CLIENT_ID (bundled nous provider).
|
|
#
|
|
# HERMES_DASHBOARD_INSECURE no longer disables the gate (June 2026 hardening:
|
|
# unauthenticated public dashboards were the entry point for the MCP-config
|
|
# persistence campaign). It is accepted but ignored; warn if set so operators
|
|
# migrate to a real provider.
|
|
case "${HERMES_DASHBOARD_INSECURE:-}" in
|
|
1|true|TRUE|True|yes|YES|Yes)
|
|
echo "[dashboard] HERMES_DASHBOARD_INSECURE no longer disables the auth gate." >&2
|
|
echo "[dashboard] A non-loopback dashboard requires an auth provider:" >&2
|
|
echo "[dashboard] set HERMES_DASHBOARD_BASIC_AUTH_USERNAME + _PASSWORD (password)" >&2
|
|
echo "[dashboard] or HERMES_DASHBOARD_OAUTH_CLIENT_ID (OAuth)." >&2
|
|
;;
|
|
esac
|
|
|
|
# Skip the drop when already non-root.
|
|
[ "$(id -u)" = 0 ] || exec hermes dashboard --host "$dash_host" --port "$dash_port" --no-open
|
|
exec s6-setuidgid hermes hermes dashboard \
|
|
--host "$dash_host" --port "$dash_port" --no-open
|