From 8a087c4e85a229cbbc4c34f3ac6a767d2c04a55c Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Fri, 5 Jun 2026 11:23:01 -0700
Subject: [PATCH] feat(dkai-hermes): add Hermes controller template for remote
 Enodios vLLM

Workspace runs Hermes Agent only and connects outbound to vllm.dataknife.net;
Enodios inference stays off-pod. Wire CI, Makefile, and docs for the new template.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .cursor/rules/project.mdc                     |   6 +-
 .cursor/rules/terraform-coder.mdc             |   4 +-
 .github/workflows/ci.yaml                     |   2 +-
 .gitlab-ci.yml                                |   9 +-
 Makefile                                      |   7 +-
 README.md                                     |   6 +-
 docs/build-parameters.md                      |   1 +
 scripts/check-dkai-startup-shell.sh           |   1 +
 templates/dkai-hermes/README.md               |  82 ++
 templates/dkai-hermes/main.tf                 | 790 ++++++++++++++++++
 .../scripts/tool-shared-pvc-exists.sh         |  53 ++
 templates/dkai-hermes/terraform.tfvars        |   1 +
 12 files changed, 952 insertions(+), 10 deletions(-)
 create mode 100644 templates/dkai-hermes/README.md
 create mode 100644 templates/dkai-hermes/main.tf
 create mode 100755 templates/dkai-hermes/scripts/tool-shared-pvc-exists.sh
 create mode 100644 templates/dkai-hermes/terraform.tfvars

diff --git a/.cursor/rules/project.mdc b/.cursor/rules/project.mdc
index f169cf3..d7d255c 100644
--- a/.cursor/rules/project.mdc
+++ b/.cursor/rules/project.mdc
@@ -7,8 +7,8 @@ alwaysApply: true
 
 Terraform-based Coder workspace templates for DataKnife.
 
-- **Templates**: `templates/kubernetes/`, `templates/dkai-dev/`, `templates/dkai-arch/`, `templates/dkai-agent/`
-- **DKAI naming**: Coder **display name** = `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent); **internal ID** = `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`). Template icons: DevPod `k8s.svg`, Arch `cursor.svg`, Agent `k8s.svg` (distinct roles in the UI).
+- **Templates**: `templates/kubernetes/`, `templates/dkai-dev/`, `templates/dkai-arch/`, `templates/dkai-agent/`, `templates/dkai-hermes/`
+- **DKAI naming**: Coder **display name** = `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent, DKAI Hermes); **internal ID** = `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes`). Template icons: DevPod `k8s.svg`, Arch `cursor.svg`, Agent/Hermes `k8s.svg` (distinct roles in the UI).
 - **Validation**: `make test` (init, validate, fmt-check)
 - **Docs**: `docs/build-parameters.md` — Coder parameter reference
 - **CI**: GitHub Actions + GitLab mirror; add new templates to `TEMPLATES` in Makefile and CI matrix
@@ -16,7 +16,7 @@ Terraform-based Coder workspace templates for DataKnife.
   - **Always run from the repo root** and pass **`--directory templates/<template-id>`**. The CLI uploads the current directory by default; pushing from the repo root without `--directory` fails with *no [.tf .tf.json] files* because Terraform lives under `templates/<name>/`.
   - **Same flags as GitLab CI** (`.gitlab-ci.yml` `push-to-coder` job):  
     `coder templates push "<template-id>" --directory "templates/<template-id>" --activate=false -y`  
-    Loop over `kubernetes`, `dkai-dev`, `dkai-arch`, `dkai-agent` as in CI when you need everything.
+    Loop over `kubernetes`, `dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes` as in CI when you need everything.
   - **`--activate=false`** uploads a new version but does **not** make it the default. To test a workspace on that build: **`coder templates versions promote --template <id> --template-version <version_name> -O <org>`**, then **`coder update <workspace>`** (or rebuild from the UI). List versions with **`coder templates versions list <id>`**; pick the newest row or use JSON if needed.
   - **Optional Makefile helpers** (extra Terraform flags for non-interactive push): **`make template-push TEMPLATE=dkai-agent`** or **`make push-dkai-agent`** — same `--directory` idea with absolute paths, `terraform.tfvars`, `--ignore-lockfile`, `-O coder`.
   - **Verify after deploy**: **`coder show <workspace>`** (agent healthy / startup), **`coder logs <workspace>`** (errors at end of startup), **`./scripts/coder-workspace-debug.sh <name>`** for a bundled grep. **`coder provisioner jobs list -l 10`** if a push sits silent (import still running).
diff --git a/.cursor/rules/terraform-coder.mdc b/.cursor/rules/terraform-coder.mdc
index 19f0945..db070bc 100644
--- a/.cursor/rules/terraform-coder.mdc
+++ b/.cursor/rules/terraform-coder.mdc
@@ -9,8 +9,8 @@ alwaysApply: false
 ## Project Context
 
 - Custom Coder workspace templates for DataKnife
-- **DKAI templates**: display name `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent); internal ID / directory `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`).
-- Templates: `kubernetes` (code-server), `dkai-dev` / `dkai-arch` / `dkai-agent` (Cursor CLI via startup script, no subdomain; Arch variants use `archlinux` image; `dkai-arch` uses `coder/cursor` module for Desktop button; `dkai-agent` omits that module, uses `coder_env` + end-of-startup script to auto-start `agent worker start` without `--pool` when `cursor_api_key` is set — individual account API key, not team pool)
+- **DKAI templates**: display name `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent, DKAI Hermes); internal ID / directory `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes`).
+- Templates: `kubernetes` (code-server), `dkai-dev` / `dkai-arch` / `dkai-agent` / `dkai-hermes` (Cursor CLI via startup script on dev/arch only; Arch variants use `archlinux` image; `dkai-arch` uses `coder/cursor` module for Desktop button; `dkai-agent` omits that module, uses `coder_env` + end-of-startup script to auto-start `agent worker start` without `--pool` when `cursor_api_key` is set; `dkai-hermes` Hermes controller only — remote Enodios vLLM at vllm.dataknife.net (Enodios not installed in workspace), no Cursor worker)
 - Validate with `make test` before committing
 
 ## Coder Provider
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 67bb94f..a08d8bc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         # Add new template directories here when created
-        template: [kubernetes, dkai-dev, dkai-arch, dkai-agent]
+        template: [kubernetes, dkai-dev, dkai-arch, dkai-agent, dkai-hermes]
     steps:
       - name: Checkout
         uses: actions/checkout@v5
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b3636b2..b5c68cb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,6 +62,12 @@ test:dkai-agent:
     TEMPLATE_NAME: dkai-agent
   # Startup shell is checked in test:dkai-arch (scripts/check-dkai-startup-shell.sh covers all Arch templates)
 
+test:dkai-hermes:
+  <<: *test_template
+  variables:
+    TEMPLATE_NAME: dkai-hermes
+  # Startup shell is checked in test:dkai-arch (scripts/check-dkai-startup-shell.sh covers all Arch templates)
+
 push-to-coder:
   stage: deploy
   tags:
@@ -72,13 +78,14 @@ push-to-coder:
     - test:dkai-dev
     - test:dkai-arch
     - test:dkai-agent
+    - test:dkai-hermes
   before_script:
     - apt-get update && apt-get install -y curl ca-certificates
     - curl -fsSL https://coder.dataknife.net/install.sh | sh -s --
     - coder version
   script:
     - |
-      for template in kubernetes dkai-dev dkai-arch dkai-agent; do
+      for template in kubernetes dkai-dev dkai-arch dkai-agent dkai-hermes; do
         if [ -d "templates/$template" ]; then
           echo "Pushing template: $template"
           coder templates push "$template" --directory "templates/$template" --activate=false -y
diff --git a/Makefile b/Makefile
index 8f26b0d..5259b6c 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,7 @@
 
 .NOTPARALLEL:
 
-TEMPLATES := kubernetes dkai-dev dkai-arch dkai-agent
+TEMPLATES := kubernetes dkai-dev dkai-arch dkai-agent dkai-hermes
 TERRAFORM := terraform
 
 # V=1 enables verbose/debug output
@@ -25,7 +25,7 @@ CODER_ORGANIZATION ?= coder
 # Kubernetes namespace for templates that define var.namespace (must match templates/<name>/terraform.tfvars)
 K8S_NAMESPACE ?= coder-workspaces
 
-.PHONY: test test-all fmt-check init validate clean fmt debug check-dkai-startup template-push push-dkai-agent
+.PHONY: test test-all fmt-check init validate clean fmt debug check-dkai-startup template-push push-dkai-agent push-dkai-hermes
 
 # Validate all templates (init, validate, format check)
 test: test-all
@@ -94,3 +94,6 @@ template-push:
 
 push-dkai-agent:
 	@$(MAKE) template-push TEMPLATE=dkai-agent MSG="$(MSG)"
+
+push-dkai-hermes:
+	@$(MAKE) template-push TEMPLATE=dkai-hermes MSG="$(MSG)"
diff --git a/README.md b/README.md
index b16b5cd..b387e9d 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,7 @@ This repository contains reusable Coder templates for provisioning development w
 | **DKAI DevPod** (`dkai-dev`) | Cursor IDE on Kubernetes (Ubuntu) — 2/4 CPU, 4/8 GB RAM, 50–100 GB disk (no subdomain required) |
 | **DKAI Arch** (`dkai-arch`) | Same as **DKAI DevPod** on **Arch Linux** (`archlinux` image, pacman, gh/glab from repos) |
 | **DKAI Agent** (`dkai-agent`) | **DKAI Arch** plus Cloud Agent worker (`start-cursor-worker`), second PVC for tool configs (`kubectl` / `rancher` / gh / glab), individual API key |
+| **DKAI Hermes** (`dkai-hermes`) | **Hermes Agent** controller → remote **[Enodios](https://github.com/DataKnifeAI/enodios) vLLM** (`vllm.dataknife.net`; Enodios does not run in the workspace) |
 
 ## References
 
@@ -76,7 +77,10 @@ coder-templates/
     ├── dkai-arch/
     │   ├── main.tf
     │   └── README.md
-    └── dkai-agent/
+    ├── dkai-agent/
+    │   ├── main.tf
+    │   └── README.md
+    └── dkai-hermes/
         ├── main.tf
         └── README.md
 ```
diff --git a/docs/build-parameters.md b/docs/build-parameters.md
index ae7e6f5..83bff17 100644
--- a/docs/build-parameters.md
+++ b/docs/build-parameters.md
@@ -25,4 +25,5 @@ Topics covered include:
 | DKAI DevPod (`dkai-dev`) | CPU (2/4 cores), Memory (4/8 GB), Home disk size (50–100 GB, monotonic ↑). Cursor IDE only (no subdomain). |
 | DKAI Arch (`dkai-arch`) | Same parameters as **DKAI DevPod** (`dkai-dev`). Arch Linux base image; Cursor IDE only (no subdomain). |
 | DKAI Agent (`dkai-agent`) | Same CPU/memory/home disk as DKAI Arch, plus **tool_config_disk_size** (default 5 GiB, 1–50 GiB) for the shared **ReadWriteMany** tool-config PVC at `/mnt/coder-tool-config` (one per Coder owner: `coder-<owner-id>-tool-config`; plan-time cluster check creates if missing else attaches). **cursor_worker_idle_timeout** (30–86400 s, default 600) for `agent worker start --idle-release-timeout`; optional **cursor_api_key** (masked; `CURSOR_API_KEY` via `coder_env`). |
+| DKAI Hermes (`dkai-hermes`) | Same as **DKAI Agent** (tool PVC, gh/glab/kubectl/rancher), but **Hermes Agent controller only** — **[Enodios](https://github.com/DataKnifeAI/enodios) vLLM runs remotely** (not in workspace). Hermes config points at **vllm_base_url** (default `https://vllm.dataknife.net/v1`), **vllm_model** (`hermes3:8b`), optional **vllm_api_key**; optional **hermes_worker_git_url** for project code. |
 | kubernetes| See [templates/kubernetes/README.md](../templates/kubernetes/README.md)   |
diff --git a/scripts/check-dkai-startup-shell.sh b/scripts/check-dkai-startup-shell.sh
index 6b0f251..4c2c021 100755
--- a/scripts/check-dkai-startup-shell.sh
+++ b/scripts/check-dkai-startup-shell.sh
@@ -6,6 +6,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 TEMPLATES=(
   dkai-arch
   dkai-agent
+  dkai-hermes
 )
 
 for name in "${TEMPLATES[@]}"; do
diff --git a/templates/dkai-hermes/README.md b/templates/dkai-hermes/README.md
new file mode 100644
index 0000000..ed29513
--- /dev/null
+++ b/templates/dkai-hermes/README.md
@@ -0,0 +1,82 @@
+---
+display_name: DKAI Hermes
+description: Hermes Agent controller on Kubernetes — remote Enodios vLLM at vllm.dataknife.net
+icon: /icon/k8s.svg
+maintainer_github: coder
+verified: false
+tags: [kubernetes, container, archlinux, hermes, enodios, vllm, remote-llm]
+---
+
+# DKAI Hermes
+
+**Hermes Agent controller** on Kubernetes, wired to **remote [Enodios](https://github.com/DataKnifeAI/enodios) vLLM** at **`https://vllm.dataknife.net/v1`**.
+
+**Enodios does not run in this workspace.** Enodios is the remote inference stack (vLLM on GPU / DataKnife-hosted). This pod installs **Hermes only** and connects outbound over HTTPS. No `enodios install`, no local vLLM, no GPU required in the workspace.
+
+```
+You ──► Hermes Agent (this Coder workspace — tools, files, terminal)
+              │
+              │  OpenAI-compatible API
+              ▼
+         Remote Enodios vLLM (vllm.dataknife.net — outside workspace)
+```
+
+## What runs where
+
+| Component | Location | In workspace? |
+|-----------|----------|---------------|
+| **Enodios / vLLM** | GPU host or `vllm.dataknife.net` | **No** |
+| **Hermes Agent** | Coder workspace pod | **Yes** |
+| **Your code** | Optional git clone under `/home/coder/<repo>/` | **Yes** |
+
+## What you get
+
+- **`hermes` CLI** — agent with tools; config on tool PVC at `~/.hermes`.
+- **Remote vLLM parameters** — Hermes `custom_providers` block (Enodios layout) rewritten each start:
+  - **`vllm_base_url`** — default `https://vllm.dataknife.net/v1`
+  - **`vllm_model`** — default `hermes3:8b`
+  - **`vllm_api_key`** — optional, for authenticated endpoints
+- **`hermes_worker_git_url`** — optional project repo (default `agent-workspace`); not Enodios itself.
+- **`start-hermes-chat`** — `hermes chat` from cloned repo or `/home/coder`.
+- **Startup probe** — `GET <base-url>/models` reachability check.
+
+## Quick start
+
+1. Ensure remote Enodios vLLM is up at `vllm.dataknife.net` (or your `vllm_base_url`).
+2. Create workspace; confirm startup shows **vLLM reachability: ok**.
+3. Chat:
+
+   ```bash
+   start-hermes-chat
+   ```
+
+## Parameters
+
+| Parameter | Default | Notes |
+|-----------|---------|-------|
+| `vllm_base_url` | `https://vllm.dataknife.net/v1` | Remote Enodios endpoint (reachable from pods) |
+| `vllm_model` | `hermes3:8b` | Must match remote `/v1/models` |
+| `vllm_api_key` | (empty) | If remote vLLM requires auth |
+| `hermes_worker_git_url` | `agent-workspace` repo | Your project code — not Enodios |
+
+## Operating Enodios (remote)
+
+Enodios is managed on the inference side. See **[Enodios docs](https://dataknifeai.github.io/enodios/)** for GPU host setup (`enodios install`, `enodios start --lan`, etc.). Controllers (this template) only need Hermes pointed at the remote URL.
+
+## Relationship to DKAI Agent
+
+Same Kubernetes layout and CLI tooling (`gh`, `glab`, `kubectl`, `rancher`). Replaces Cursor Cloud Agent with **Hermes → remote Enodios vLLM**.
+
+Git / `gh` / `glab` shared paths: **[DKAI Agent README](../dkai-agent/README.md#git-gh--glab-and-home)**.
+
+## Debugging
+
+```bash
+coder ssh <workspace> -- sh -c 'cat /mnt/coder-tool-config/hermes/config.yaml'
+coder ssh <workspace> -- sh -c 'curl -fsS "https://vllm.dataknife.net/v1/models" | head -c 500'
+```
+
+## Related
+
+- [Enodios](https://github.com/DataKnifeAI/enodios) · [Docs](https://dataknifeai.github.io/enodios/) (remote inference stack)
+- [Hermes Agent](https://hermes-agent.nousresearch.com/)
diff --git a/templates/dkai-hermes/main.tf b/templates/dkai-hermes/main.tf
new file mode 100644
index 0000000..2f34d6c
--- /dev/null
+++ b/templates/dkai-hermes/main.tf
@@ -0,0 +1,790 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 2.12"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "~> 2.3"
+    }
+  }
+  required_version = ">= 1.5.0"
+}
+
+provider "coder" {
+}
+
+variable "use_kubeconfig" {
+  type        = bool
+  description = <<-EOF
+  Use host kubeconfig? (true/false)
+
+  Set this to false if the Coder host is itself running as a Pod on the same
+  Kubernetes cluster as you are deploying workspaces to.
+
+  Set this to true if the Coder host is running outside the Kubernetes cluster
+  for workspaces.  A valid "~/.kube/config" must be present on the Coder host.
+  EOF
+  default     = false
+}
+
+variable "namespace" {
+  type        = string
+  description = "The Kubernetes namespace to create workspaces in (must exist prior to creating workspaces). If the Coder host is itself running as a Pod on the same Kubernetes cluster as you are deploying workspaces to, set this to the same namespace."
+  default     = "coder-workspaces"
+}
+
+data "coder_parameter" "cpu" {
+  name         = "cpu"
+  display_name = "CPU"
+  description  = "CPU limit for the workspace pod (Kubernetes limits.cpu; 2 or 4 cores)."
+  default      = "2"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "2 Cores"
+    value = "2"
+  }
+  option {
+    name  = "4 Cores"
+    value = "4"
+  }
+}
+
+data "coder_parameter" "memory" {
+  name         = "memory"
+  display_name = "Memory"
+  description  = "Memory limit for the workspace pod in GiB (Kubernetes limits.memory as 4Gi or 8Gi)."
+  default      = "4"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "4 GB"
+    value = "4"
+  }
+  option {
+    name  = "8 GB"
+    value = "8"
+  }
+}
+
+data "coder_parameter" "home_disk_size" {
+  name         = "home_disk_size"
+  display_name = "Home disk size"
+  description  = "Size of the home PVC for /home/coder in GiB (Kubernetes storage request N Gi). Range 50–100 GiB; can only be increased after creation."
+  default      = "50"
+  type         = "number"
+  icon         = "/emojis/1f4be.png"
+  mutable      = true
+  validation {
+    min       = 50
+    max       = 100
+    monotonic = "increasing"
+  }
+}
+
+data "coder_parameter" "tool_config_disk_size" {
+  name         = "tool_config_disk_size"
+  display_name = "Tool config disk (kube, gh, glab-cli, coder, rancher)"
+  description  = "Size in GiB of the shared ReadWriteMany tool-config PVC at /mnt/coder-tool-config (default 5 GiB; range 1–50 GiB; monotonic increase). One PVC per Coder owner (coder-<owner-id>-tool-config); all your dkai-hermes workspaces share it. Plan-time cluster check creates the PVC if missing, otherwise attaches to the existing claim."
+  default      = "5"
+  type         = "number"
+  icon         = "/emojis/1f4be.png"
+  mutable      = true
+  validation {
+    min       = 1
+    max       = 50
+    monotonic = "increasing"
+  }
+}
+
+data "coder_parameter" "vllm_base_url" {
+  name         = "vllm_base_url"
+  display_name = "Remote vLLM OpenAI base URL"
+  description  = "Remote Enodios vLLM OpenAI endpoint (must include /v1). Enodios inference runs outside this workspace — default https://vllm.dataknife.net/v1. This pod only runs Hermes and connects outbound."
+  type         = "string"
+  form_type    = "input"
+  default      = "https://vllm.dataknife.net/v1"
+  mutable      = true
+  icon         = "/icon/memory.svg"
+}
+
+data "coder_parameter" "vllm_model" {
+  name         = "vllm_model"
+  display_name = "vLLM model name (Enodios)"
+  description  = "Model id on the remote Enodios vLLM (GET <base-url>/models). Default hermes3:8b matches the DataKnife Enodios deployment."
+  type         = "string"
+  form_type    = "input"
+  default      = "hermes3:8b"
+  mutable      = true
+  icon         = "/emojis/1f916.png"
+}
+
+data "coder_parameter" "vllm_api_key" {
+  name         = "vllm_api_key"
+  display_name = "vLLM API key (optional)"
+  description  = "Optional. API key for the remote vLLM server (when started with --api-key or behind an auth proxy). Written to ~/.hermes/config.yaml on each workspace start."
+  type         = "string"
+  form_type    = "input"
+  default      = ""
+  mutable      = true
+  icon         = "/emojis/1f511.png"
+  styling = jsonencode({
+    mask_input = true
+  })
+}
+
+data "coder_parameter" "hermes_worker_git_url" {
+  name         = "hermes_worker_git_url"
+  display_name = "Hermes workspace Git repo (HTTPS)"
+  description  = "Optional project repo for Hermes sessions: cloned under /home/coder/<repo>/ at startup. Enodios (remote vLLM) does not run in this workspace — only Hermes + your code checkout. Clear to use /home/coder only."
+  type         = "string"
+  form_type    = "input"
+  default      = "https://github.com/DataKnifeAI/agent-workspace.git"
+  mutable      = true
+  icon         = "/icon/github.svg"
+}
+
+provider "kubernetes" {
+  # Authenticate via ~/.kube/config or a Coder-specific ServiceAccount, depending on admin preferences
+  config_path = var.use_kubeconfig == true ? "~/.kube/config" : null
+}
+
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
+locals {
+  # One ReadWriteMany tool-config PVC per Coder owner (not per workspace).
+  tool_config_user_pvc_name = "coder-${data.coder_workspace_owner.me.id}-tool-config"
+}
+
+# Plan-time: shared PVC may already exist (another workspace created it). Avoid AlreadyExists on create.
+# Probe with the same auth the kubernetes provider uses: in-cluster ServiceAccount + API when
+# use_kubeconfig is false (kubectl is often not installed on the Coder pod).
+data "external" "tool_shared_pvc_exists" {
+  program = [
+    "${path.module}/scripts/tool-shared-pvc-exists.sh",
+    var.namespace,
+    local.tool_config_user_pvc_name,
+    var.use_kubeconfig ? "true" : "false",
+    pathexpand("~/.kube/config"),
+  ]
+}
+
+locals {
+  tool_shared_pvc_exists = data.external.tool_shared_pvc_exists.result.exists == "true"
+  # Import map: when the PVC already exists in the cluster, adopt it into this workspace's state so we
+  # never flip count 1→0 (which would plan a destroy on the next apply after the creating workspace).
+  tool_shared_pvc_import = local.tool_shared_pvc_exists ? { import = true } : {}
+}
+
+resource "coder_agent" "main" {
+  os   = "linux"
+  arch = "amd64"
+  # Blocking: workspace is not ready until this script exits.
+  startup_script_behavior = "blocking"
+  display_apps {
+    vscode = false
+  }
+  startup_script = <<-EOT
+    set -e
+    # Pod runs as root (see deployment); pacman installs tools, then UID 1000 under /home/coder.
+    # Mask detect-old-perl-modules: that hook can invoke sudo on some K8s nodes; bash permission denied.
+    mkdir -p /etc/pacman.d/hooks
+    printf "%s\n" \
+      "[Action]" \
+      "Description = Skip old perl modules check (Coder/K8s)" \
+      "When = PostTransaction" \
+      "Exec = /usr/bin/true" \
+      >/etc/pacman.d/hooks/detect-old-perl-modules.hook
+    pacman -Sy --needed --noconfirm --disable-sandbox \
+      apparmor bash binutils curl git kubectl kubectx nano nodejs python zstd
+    # Git 2.35+: "dubious ownership" when .git owner != invoking user (NFS root_squash → nobody, or root in a coder-owned tree).
+    git config --system --add safe.directory '*' 2>/dev/null || true
+    # Coder often sets GIT_ASKPASS for git; neutralize so gh/glab credential helpers can supply HTTPS tokens.
+    printf '%s\n' \
+      '# Managed by DKAI Hermes template (see templates/dkai-hermes/README.md).' \
+      'export GIT_ASKPASS=true' \
+      >/etc/profile.d/dkai-git-askpass.sh
+    chmod 0644 /etc/profile.d/dkai-git-askpass.sh
+    # Optional CLI downloads must not fail the whole startup (set -e): network blips, bad semver, etc.
+    set +e
+    # gh/glab: upstream binaries (Arch pkgs pull sudo). Each start: resolve latest stable from release APIs, reinstall if outdated.
+    # Trim GitHub release tag with sed; avoid bash prefix-strip here; Terraform treats dollar-brace as template syntax in this block.
+    # Avoid apostrophe in curl -w; avoid command-substitution open-paren on one line if the agent strips dollar signs.
+    CFMT=%%{url_effective}
+    curl -fsSIL -A "Mozilla/5.0" -o /dev/null -w "$${CFMT}" https://github.com/cli/cli/releases/latest 2>/dev/null > /tmp/dkai-gh-url || true
+    read -r GH_URL < /tmp/dkai-gh-url || true
+    GH_TAG=$${GH_URL##*/}
+    T="$${GH_TAG}" python3 -c "import os; print(os.environ.get(\"T\",\"\").removeprefix(\"v\"))" 2>/dev/null > /tmp/dkai-gh-ver || true
+    read -r GH_VERSION < /tmp/dkai-gh-ver || true
+    [ -n "$${GH_VERSION}" ] || GH_VERSION=2.89.0
+    printf "%s" "$${GH_VERSION}" | grep -qE '^[0-9]+\\.[0-9]+\\.[0-9]+$$' || GH_VERSION=2.89.0
+    GH_CUR=
+    if command -v gh >/dev/null 2>&1; then
+      gh version 2>/dev/null | head -n1 | sed -E "s/^gh version ([0-9.]+).*/\\1/" > /tmp/dkai-gh-cur || true
+      read -r GH_CUR < /tmp/dkai-gh-cur || true
+    fi
+    if [ "$${GH_CUR}" != "$${GH_VERSION}" ]; then
+      if curl -fsSL "https://github.com/cli/cli/releases/download/v$${GH_VERSION}/gh_$${GH_VERSION}_linux_amd64.tar.gz" -o /tmp/gh.tgz; then
+        tar -xzf /tmp/gh.tgz -C /tmp
+        install -m 0755 "/tmp/gh_$${GH_VERSION}_linux_amd64/bin/gh" /usr/local/bin/gh
+        rm -rf "/tmp/gh_$${GH_VERSION}_linux_amd64" /tmp/gh.tgz
+      fi
+    fi
+    curl -fsSL "https://gitlab.com/api/v4/projects/gitlab-org%2Fcli/releases/permalink/latest" -o /tmp/dkai-glab-json 2>/dev/null || true
+    python3 -c "import sys,json; t=json.load(sys.stdin)[\"tag_name\"]; print(t.removeprefix(\"v\"))" < /tmp/dkai-glab-json > /tmp/dkai-glab-ver 2>/dev/null || true
+    read -r GLAB_VERSION < /tmp/dkai-glab-ver || true
+    [ -n "$${GLAB_VERSION}" ] || GLAB_VERSION=1.92.0
+    printf "%s" "$${GLAB_VERSION}" | grep -qE '^[0-9]+\\.[0-9]+\\.[0-9]+$$' || GLAB_VERSION=1.92.0
+    GLAB_CUR=
+    if command -v glab >/dev/null 2>&1; then
+      glab version 2>/dev/null | head -n1 | sed -E "s/.*([0-9]+\\.[0-9]+\\.[0-9]+).*/\\1/" > /tmp/dkai-glab-cur || true
+      read -r GLAB_CUR < /tmp/dkai-glab-cur || true
+    fi
+    if [ "$${GLAB_CUR}" != "$${GLAB_VERSION}" ]; then
+      if curl -fsSL "https://gitlab.com/gitlab-org/cli/-/releases/v$${GLAB_VERSION}/downloads/glab_$${GLAB_VERSION}_linux_amd64.tar.gz" -o /tmp/glab.tgz; then
+        tar -xzf /tmp/glab.tgz -C /tmp
+        install -m 0755 /tmp/bin/glab /usr/local/bin/glab
+        rm -rf /tmp/bin /tmp/glab.tgz
+      fi
+    fi
+    # kubectl: installed from Arch extra (pacman above). Avoid dl.k8s.io curl — flaky behind some networks.
+    # kubectx Arch package installs kubectx + kubens (https://github.com/ahmetb/kubectx) — context/namespace switchers.
+    # Rancher CLI: read Location from /releases/latest (no GitHub API — unauthenticated api.github.com is rate-limited in shared clusters).
+    if ! command -v rancher >/dev/null 2>&1; then
+      RANCHER_LOC=$(/usr/bin/curl -sI --no-styled-output -A "Mozilla/5.0" https://github.com/rancher/cli/releases/latest 2>/dev/null | grep -i '^[Ll]ocation:' | awk '{print $$2}' | tr -d '\r' | head -n1 || true)
+      RANCHER_VER=$${RANCHER_LOC##*/}
+      if [ -n "$${RANCHER_VER}" ] && /usr/bin/curl -fsSL "https://github.com/rancher/cli/releases/download/$${RANCHER_VER}/rancher-linux-amd64-$${RANCHER_VER}.tar.gz" -o /tmp/rancher-cli.tgz; then
+        mkdir -p /tmp/rancher-extract
+        tar -xzf /tmp/rancher-cli.tgz -C /tmp/rancher-extract
+        find /tmp/rancher-extract -name rancher -type f 2>/dev/null | head -n1 > /tmp/dkai-rancher-binpath
+        read -r RBIN < /tmp/dkai-rancher-binpath
+        if [ -n "$${RBIN}" ]; then
+          install -m 0755 "$${RBIN}" /usr/local/bin/rancher
+        fi
+        rm -f /tmp/dkai-rancher-binpath
+        rm -rf /tmp/rancher-cli.tgz /tmp/rancher-extract
+      fi
+    fi
+    set -e
+    if ! id -u coder >/dev/null 2>&1; then
+      # PVC is usually mounted at /home/coder before this runs; -m would warn and skip skel.
+      # Prefer UID 1000; if taken, fall back so startup does not abort under set -e.
+      if [ -d /home/coder ]; then
+        useradd --no-create-home -u 1000 -d /home/coder -s /bin/bash coder 2>/dev/null || \
+        useradd --no-create-home -d /home/coder -s /bin/bash coder || true
+      else
+        useradd -m -u 1000 -s /bin/bash coder 2>/dev/null || \
+        useradd -m -s /bin/bash coder || true
+      fi
+    fi
+    # Only chown when the account exists; avoid invoking chown with a nonexistent user name.
+    _chown_coder() { id -u coder >/dev/null 2>&1 && chown "$$@"; }
+    # May fail on NFS (root_squash); home should already be UID/GID 1000 from storage.
+    _chown_coder -R coder:coder /home/coder 2>/dev/null || true
+    # Second PVC (/mnt/coder-tool-config): symlinks from /root and /home/coder (see below).
+    mkdir -p /mnt/coder-tool-config/kube /mnt/coder-tool-config/config/gh /mnt/coder-tool-config/config/glab-cli /mnt/coder-tool-config/config/coderv2 /mnt/coder-tool-config/rancher /mnt/coder-tool-config/hermes
+    # Coder CLI v2 uses ~/.config/coderv2 (--global-config / $CODER_CONFIG_DIR), not ~/.config/coder.
+    if [ -d /mnt/coder-tool-config/config/coder ] && [ -z "$$(ls -A /mnt/coder-tool-config/config/coderv2 2>/dev/null)" ]; then
+      cp -a /mnt/coder-tool-config/config/coder/. /mnt/coder-tool-config/config/coderv2/ 2>/dev/null || true
+    fi
+    if ! grep -q '[[:space:]]/mnt/coder-tool-config[[:space:]]' /proc/mounts 2>/dev/null; then
+      echo "WARN: /mnt/coder-tool-config is not listed in /proc/mounts — tool PVC may not be mounted; configs might not persist." >&2
+    fi
+    mkdir -p /home/coder/.config
+    # Merge then remove legacy /home/coder tool paths (older templates symlinked paths; we no longer link /home/coder to this PVC).
+    if [ -d /home/coder/.kube ] && [ ! -L /home/coder/.kube ]; then
+      cp -a /home/coder/.kube/. /mnt/coder-tool-config/kube/ 2>/dev/null || true
+      rm -rf /home/coder/.kube
+    elif [ -L /home/coder/.kube ]; then
+      rm -f /home/coder/.kube
+    fi
+    if [ -d /home/coder/.config/gh ] && [ ! -L /home/coder/.config/gh ]; then
+      cp -a /home/coder/.config/gh/. /mnt/coder-tool-config/config/gh/ 2>/dev/null || true
+      rm -rf /home/coder/.config/gh
+    elif [ -L /home/coder/.config/gh ]; then
+      rm -f /home/coder/.config/gh
+    fi
+    if [ -d /home/coder/.config/glab-cli ] && [ ! -L /home/coder/.config/glab-cli ]; then
+      cp -a /home/coder/.config/glab-cli/. /mnt/coder-tool-config/config/glab-cli/ 2>/dev/null || true
+      rm -rf /home/coder/.config/glab-cli
+    elif [ -L /home/coder/.config/glab-cli ]; then
+      rm -f /home/coder/.config/glab-cli
+    fi
+    if [ -d /home/coder/.config/coderv2 ] && [ ! -L /home/coder/.config/coderv2 ]; then
+      cp -a /home/coder/.config/coderv2/. /mnt/coder-tool-config/config/coderv2/ 2>/dev/null || true
+      rm -rf /home/coder/.config/coderv2
+    elif [ -L /home/coder/.config/coderv2 ]; then
+      rm -f /home/coder/.config/coderv2
+    fi
+    if [ -d /home/coder/.config/coder ] && [ ! -L /home/coder/.config/coder ]; then
+      cp -a /home/coder/.config/coder/. /mnt/coder-tool-config/config/coderv2/ 2>/dev/null || true
+      rm -rf /home/coder/.config/coder
+    elif [ -L /home/coder/.config/coder ]; then
+      rm -f /home/coder/.config/coder
+    fi
+    if [ -d /home/coder/.rancher ] && [ ! -L /home/coder/.rancher ]; then
+      cp -a /home/coder/.rancher/. /mnt/coder-tool-config/rancher/ 2>/dev/null || true
+      rm -rf /home/coder/.rancher
+    elif [ -L /home/coder/.rancher ]; then
+      rm -f /home/coder/.rancher
+    fi
+    # Point root's config paths at the PVC (default interactive user in this pod).
+    mkdir -p /root/.config
+    if [ -d /root/.kube ] && [ ! -L /root/.kube ]; then
+      cp -a /root/.kube/. /mnt/coder-tool-config/kube/ 2>/dev/null || true
+      rm -rf /root/.kube
+    fi
+    ln -sfn /mnt/coder-tool-config/kube /root/.kube
+    if [ -d /root/.config/gh ] && [ ! -L /root/.config/gh ]; then
+      cp -a /root/.config/gh/. /mnt/coder-tool-config/config/gh/ 2>/dev/null || true
+      rm -rf /root/.config/gh
+    fi
+    ln -sfn /mnt/coder-tool-config/config/gh /root/.config/gh
+    # glab: XDG ~/.config/glab-cli (legacy under /home/coder merged above; PVC is source of truth)
+    rm -f /root/.config/glab 2>/dev/null
+    rm -rf /root/.config/glab /root/.config/glab-cli 2>/dev/null
+    ln -sfn /mnt/coder-tool-config/config/glab-cli /root/.config/glab-cli
+    if [ -d /root/.config/coderv2 ] && [ ! -L /root/.config/coderv2 ]; then
+      cp -a /root/.config/coderv2/. /mnt/coder-tool-config/config/coderv2/ 2>/dev/null || true
+      rm -rf /root/.config/coderv2
+    fi
+    if [ -d /root/.config/coder ] && [ ! -L /root/.config/coder ]; then
+      cp -a /root/.config/coder/. /mnt/coder-tool-config/config/coderv2/ 2>/dev/null || true
+      rm -rf /root/.config/coder
+    fi
+    ln -sfn /mnt/coder-tool-config/config/coderv2 /root/.config/coderv2
+    if [ -d /root/.rancher ] && [ ! -L /root/.rancher ]; then
+      cp -a /root/.rancher/. /mnt/coder-tool-config/rancher/ 2>/dev/null || true
+      rm -rf /root/.rancher
+    fi
+    ln -sfn /mnt/coder-tool-config/rancher /root/.rancher
+    # coder: same PVC paths (HOME=/home/coder — Hermes agent, kubectl, coder CLI, gh/glab, rancher).
+    ln -sfn /mnt/coder-tool-config/kube /home/coder/.kube
+    ln -sfn /mnt/coder-tool-config/config/gh /home/coder/.config/gh
+    ln -sfn /mnt/coder-tool-config/config/glab-cli /home/coder/.config/glab-cli
+    ln -sfn /mnt/coder-tool-config/config/coderv2 /home/coder/.config/coderv2
+    ln -sfn /mnt/coder-tool-config/rancher /home/coder/.rancher
+    ln -sfn /mnt/coder-tool-config/hermes /home/coder/.hermes
+    ln -sfn /mnt/coder-tool-config/hermes /root/.hermes
+    # coder:coder on tool PVC so root and coder share files without root-only tokens (fixes glab/gh as coder).
+    chown -R coder:coder /mnt/coder-tool-config/kube /mnt/coder-tool-config/rancher /mnt/coder-tool-config/config/coderv2 /mnt/coder-tool-config/config/gh /mnt/coder-tool-config/config/glab-cli /mnt/coder-tool-config/hermes 2>/dev/null || true
+    if command -v git >/dev/null 2>&1; then
+      if [ -x /usr/local/bin/gh ]; then
+        git config --global credential.https://github.com.helper '!/usr/local/bin/gh auth git-credential'
+      fi
+      if [ -x /usr/local/bin/glab ]; then
+        git config --global credential.https://gitlab.com.helper '!/usr/local/bin/glab auth git-credential'
+      fi
+      if id -u coder >/dev/null 2>&1; then
+        if command -v runuser >/dev/null 2>&1; then
+          [ -x /usr/local/bin/gh ] && runuser -u coder -- git config --global credential.https://github.com.helper '!/usr/local/bin/gh auth git-credential' || true
+          [ -x /usr/local/bin/glab ] && runuser -u coder -- git config --global credential.https://gitlab.com.helper '!/usr/local/bin/glab auth git-credential' || true
+        else
+          [ -x /usr/local/bin/gh ] && su -s /bin/bash coder -c "git config --global credential.https://github.com.helper '!/usr/local/bin/gh auth git-credential'" || true
+          [ -x /usr/local/bin/glab ] && su -s /bin/bash coder -c "git config --global credential.https://gitlab.com.helper '!/usr/local/bin/glab auth git-credential'" || true
+        fi
+      fi
+    fi
+    # Optional project repo for Hermes (Enodios vLLM is remote — not cloned or run here).
+    mkdir -p /home/coder
+    _chown_coder coder:coder /home/coder 2>/dev/null || true
+    WORKER_GIT_URL="${trimspace(data.coder_parameter.hermes_worker_git_url.value)}"
+    WORKER_REPO_NAME=
+    if [ -n "$${WORKER_GIT_URL}" ]; then
+      WORKER_REPO_NAME=`basename "$${WORKER_GIT_URL}" .git`
+      if [ ! -d "/home/coder/$${WORKER_REPO_NAME}/.git" ]; then
+        # git clone with no path: creates a subdir with .git inside it
+        rm -rf "/home/coder/$${WORKER_REPO_NAME}"
+        cd /home/coder
+        git clone "$${WORKER_GIT_URL}"
+      elif ! git -C "/home/coder/$${WORKER_REPO_NAME}" remote get-url origin >/dev/null 2>&1; then
+        _chown_coder -R coder:coder "/home/coder/$${WORKER_REPO_NAME}" 2>/dev/null || true
+        git -C "/home/coder/$${WORKER_REPO_NAME}" remote add origin "$${WORKER_GIT_URL}" 2>/dev/null || \
+          git -C "/home/coder/$${WORKER_REPO_NAME}" remote set-url origin "$${WORKER_GIT_URL}"
+      fi
+      if [ -d "/home/coder/$${WORKER_REPO_NAME}/.git" ]; then
+        git -C "/home/coder/$${WORKER_REPO_NAME}" remote set-url origin "$${WORKER_GIT_URL}" 2>/dev/null || true
+        git -C "/home/coder/$${WORKER_REPO_NAME}" pull --ff-only 2>/dev/null || \
+          git -C "/home/coder/$${WORKER_REPO_NAME}" pull 2>/dev/null || true
+        git -C "/home/coder/$${WORKER_REPO_NAME}" submodule update --init --recursive || true
+      fi
+      _chown_coder -R coder:coder "/home/coder/$${WORKER_REPO_NAME}" 2>/dev/null || true
+    fi
+    if ! command -v coder >/dev/null 2>&1; then
+      curl -fsSL https://coder.dataknife.net/install.sh | sh -s --
+    fi
+    # Hermes controller only — remote Enodios vLLM at vllm.dataknife.net (https://github.com/DataKnifeAI/enodios).
+    export HERMES_HOME=/mnt/coder-tool-config/hermes
+    mkdir -p "$HERMES_HOME"
+    if ! command -v hermes >/dev/null 2>&1; then
+      curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash -s -- \
+        --non-interactive --skip-browser --skip-setup --hermes-home "$HERMES_HOME"
+    fi
+    cat > "$HERMES_HOME/config.yaml" <<HERMESCFG
+model:
+  default: "${trimspace(data.coder_parameter.vllm_model.value)}"
+  provider: custom:enodios
+  context_length: 65536
+terminal:
+  backend: local
+custom_providers:
+  - name: enodios
+    base_url: "${trimspace(data.coder_parameter.vllm_base_url.value)}"
+    api_key: "${data.coder_parameter.vllm_api_key.value}"
+    models:
+      "${trimspace(data.coder_parameter.vllm_model.value)}":
+        context_length: 65536
+HERMESCFG
+    _chown_coder coder:coder "$HERMES_HOME/config.yaml" 2>/dev/null || true
+    mkdir -p /home/coder/bin
+    _chown_coder coder:coder /home/coder/bin 2>/dev/null || true
+    cat > /home/coder/bin/start-hermes-chat <<'HERMESHELPER'
+#!/usr/bin/env bash
+set -euo pipefail
+# Hermes Agent chat — inference on remote Enodios vLLM (see ~/.hermes/config.yaml).
+# Do not use VAR:-default style expansion here: Terraform parses dollar-brace in startup_script and corrupts the helper.
+REPO_ROOT="/home/coder"
+WORKDIR=$(printenv HERMES_WORKDIR 2>/dev/null || true)
+if [ -n "$WORKDIR" ]; then
+  REPO_ROOT="$WORKDIR"
+fi
+cd "$REPO_ROOT" || { echo "Repo not found: $REPO_ROOT (clone a repo or set HERMES_WORKDIR)" >&2; exit 1; }
+export HOME=/home/coder USER=coder LOGNAME=coder HERMES_HOME=/mnt/coder-tool-config/hermes
+exec hermes chat "$@"
+HERMESHELPER
+    if [ -n "$${WORKER_REPO_NAME}" ]; then
+      sed -i "s|^REPO_ROOT=\"/home/coder\"|REPO_ROOT=\"/home/coder/$${WORKER_REPO_NAME}\"|" /home/coder/bin/start-hermes-chat
+    fi
+    chmod 0755 /home/coder/bin/start-hermes-chat 2>/dev/null || true
+    _chown_coder coder:coder /home/coder/bin/start-hermes-chat 2>/dev/null || true
+    ln -sf /home/coder/bin/start-hermes-chat /usr/local/bin/start-hermes-chat 2>/dev/null || true
+    # Add ~/bin to PATH for coder user (.bashrc + .profile for login shells)
+    for f in /home/coder/.bashrc /home/coder/.profile; do
+      [ -f "$f" ] || touch "$f"
+      grep -qF '$HOME/bin' "$f" 2>/dev/null || printf "%s\n" "export PATH=\"\$HOME/bin:\$PATH\"" >> "$f"
+      grep -qF "GIT_ASKPASS=true" "$f" 2>/dev/null || printf "%s\n" \
+        "# DKAI: Coder may set GIT_ASKPASS; use gh/glab credential helpers for GitHub/GitLab HTTPS." \
+        "export GIT_ASKPASS=true" >> "$f"
+    done
+    echo ""
+    echo "=== Startup summary ==="
+    echo ""
+    echo "git"
+    git --version 2>/dev/null || echo "  (not found)"
+    echo ""
+    echo "Node.js"
+    node -v 2>/dev/null || echo "  (not found)"
+    echo ""
+    echo "CLI tools"
+    if command -v gh >/dev/null 2>&1; then gh version 2>/dev/null | head -n1; else echo "  gh: not found"; fi
+    if command -v glab >/dev/null 2>&1; then glab version 2>/dev/null | head -n1; else echo "  glab: not found"; fi
+    if command -v kubectl >/dev/null 2>&1; then kubectl version --client=true 2>/dev/null | head -n1 || echo "  kubectl: installed"; else echo "  kubectl: not found"; fi
+    if command -v kubectx >/dev/null 2>&1; then echo "  kubectx: installed"; else echo "  kubectx: not found"; fi
+    if command -v kubens >/dev/null 2>&1; then echo "  kubens: installed"; else echo "  kubens: not found"; fi
+    if command -v rancher >/dev/null 2>&1; then rancher --version 2>/dev/null | head -n1 || echo "  rancher: installed"; else echo "  rancher: not found"; fi
+    if command -v coder >/dev/null 2>&1; then coder version 2>/dev/null | head -n1; else echo "  coder: not found"; fi
+    if command -v hermes >/dev/null 2>&1; then
+      echo -n "  hermes: "
+      hermes --version 2>/dev/null || hermes version 2>/dev/null || echo "(installed)"
+    else
+      echo "  hermes: not installed"
+    fi
+    echo ""
+    echo "Tool configs on second PVC: /mnt/coder-tool-config — /root and /home/coder symlink: .kube .config/{gh,glab-cli,coderv2} .rancher .hermes"
+    echo ""
+    echo "=== Hermes controller + remote Enodios vLLM (not in this workspace) ==="
+    echo "  Enodios (remote inference): https://github.com/DataKnifeAI/enodios — runs on GPU host / vllm.dataknife.net"
+    echo "  This workspace: Hermes Agent + tools only — no enodios install, no local vLLM"
+    echo "  Remote endpoint: ${trimspace(data.coder_parameter.vllm_base_url.value)}"
+    echo "  Model: ${trimspace(data.coder_parameter.vllm_model.value)}"
+    echo "  Config: /mnt/coder-tool-config/hermes/config.yaml (rewritten each start)"
+    echo "  Project repo: hermes_worker_git_url → /home/coder/<repo>/ (optional)"
+    echo "  Start chat: start-hermes-chat   # or: cd <repo> && hermes chat"
+    echo "  Probe remote vLLM: curl -fsS ${trimspace(data.coder_parameter.vllm_base_url.value)}/models"
+    echo ""
+    VLLM_PROBE_URL="${trimspace(data.coder_parameter.vllm_base_url.value)}"
+    VLLM_PROBE_URL="$${VLLM_PROBE_URL%/}/models"
+    echo -n "vLLM reachability ($${VLLM_PROBE_URL}): "
+    if curl -fsS --connect-timeout 5 "$${VLLM_PROBE_URL}" >/tmp/vllm-models.json 2>/dev/null; then
+      echo "ok"
+      python3 -c "import json; d=json.load(open('/tmp/vllm-models.json')); ids=[m.get('id','') for m in d.get('data',[])]; print('  models:', ', '.join(ids[:5]) + (' ...' if len(ids)>5 else ''))" 2>/dev/null || true
+    else
+      echo "unreachable (check remote vLLM is up and vllm_base_url is reachable from this pod — Service DNS, ingress, or host IP)"
+    fi
+    echo ""
+    echo "=== Other CLI (gh/glab auth is shared: /home/coder and /root use the same PVC paths) ==="
+    echo "  GitHub:  gh auth login   # ok as coder or root; Hermes uses HOME=/home/coder"
+    echo "  GitLab:  glab auth login"
+    echo "  Coder:   this workspace is linked; CLI elsewhere: coder login <your-coder-url>"
+    echo ""
+  EOT
+
+  # The following metadata blocks are optional. They are used to display
+  # information about your workspace in the dashboard. You can remove them
+  # if you don't want to display any information.
+  # For basic resources, you can use the `coder stat` command.
+  # If you need more control, you can write your own script.
+  metadata {
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Home Disk"
+    key          = "3_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "CPU Usage (Host)"
+    key          = "4_cpu_usage_host"
+    script       = "coder stat cpu --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Memory Usage (Host)"
+    key          = "5_mem_usage_host"
+    script       = "coder stat mem --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Load Average (Host)"
+    key          = "6_load_host"
+    # get load avg scaled by number of cores
+    script   = <<EOT
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
+    EOT
+    interval = 60
+    timeout  = 1
+  }
+}
+
+resource "kubernetes_persistent_volume_claim_v1" "home" {
+  metadata {
+    name      = "coder-${data.coder_workspace.me.id}-home"
+    namespace = var.namespace
+    labels = {
+      "app.kubernetes.io/name"     = "coder-pvc"
+      "app.kubernetes.io/instance" = "coder-pvc-${data.coder_workspace.me.id}"
+      "app.kubernetes.io/part-of"  = "coder"
+      //Coder-specific labels.
+      "com.coder.resource"       = "true"
+      "com.coder.workspace.id"   = data.coder_workspace.me.id
+      "com.coder.workspace.name" = data.coder_workspace.me.name
+      "com.coder.user.id"        = data.coder_workspace_owner.me.id
+      "com.coder.user.username"  = data.coder_workspace_owner.me.name
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace_owner.me.email
+    }
+  }
+  wait_until_bound = false
+  spec {
+    access_modes       = ["ReadWriteOnce"]
+    storage_class_name = "truenas-csi-nfs"
+    resources {
+      requests = {
+        storage = "${data.coder_parameter.home_disk_size.value}Gi"
+      }
+    }
+  }
+}
+
+resource "kubernetes_persistent_volume_claim_v1" "tool_shared_user" {
+  count = 1
+  lifecycle {
+    prevent_destroy = true
+  }
+  metadata {
+    name      = local.tool_config_user_pvc_name
+    namespace = var.namespace
+    labels = {
+      "app.kubernetes.io/name"     = "coder-pvc-tool-config-user"
+      "app.kubernetes.io/instance" = "coder-pvc-tool-user-${data.coder_workspace_owner.me.id}"
+      "app.kubernetes.io/part-of"  = "coder"
+      "com.coder.resource"         = "true"
+      "com.coder.user.id"          = data.coder_workspace_owner.me.id
+      "com.coder.user.username"    = data.coder_workspace_owner.me.name
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace_owner.me.email
+    }
+  }
+  wait_until_bound = true
+  spec {
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = "truenas-csi-nfs"
+    resources {
+      requests = {
+        storage = "${data.coder_parameter.tool_config_disk_size.value}Gi"
+      }
+    }
+  }
+}
+
+# Adopt pre-existing shared tool PVC into state (second+ workspace, or re-apply after create). Skipped if already in state.
+import {
+  for_each = local.tool_shared_pvc_import
+  to       = kubernetes_persistent_volume_claim_v1.tool_shared_user[0]
+  id       = "${var.namespace}/${local.tool_config_user_pvc_name}"
+}
+
+resource "kubernetes_deployment_v1" "main" {
+  count = data.coder_workspace.me.start_count
+  depends_on = [
+    kubernetes_persistent_volume_claim_v1.home,
+    kubernetes_persistent_volume_claim_v1.tool_shared_user,
+  ]
+  wait_for_rollout = false
+  metadata {
+    name      = "coder-${data.coder_workspace.me.id}"
+    namespace = var.namespace
+    labels = {
+      "app.kubernetes.io/name"     = "coder-workspace"
+      "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+      "app.kubernetes.io/part-of"  = "coder"
+      "com.coder.resource"         = "true"
+      "com.coder.workspace.id"     = data.coder_workspace.me.id
+      "com.coder.workspace.name"   = data.coder_workspace.me.name
+      "com.coder.user.id"          = data.coder_workspace_owner.me.id
+      "com.coder.user.username"    = data.coder_workspace_owner.me.name
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace_owner.me.email
+    }
+  }
+
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        "app.kubernetes.io/name"     = "coder-workspace"
+        "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+        "app.kubernetes.io/part-of"  = "coder"
+        "com.coder.resource"         = "true"
+        "com.coder.workspace.id"     = data.coder_workspace.me.id
+        "com.coder.workspace.name"   = data.coder_workspace.me.name
+        "com.coder.user.id"          = data.coder_workspace_owner.me.id
+        "com.coder.user.username"    = data.coder_workspace_owner.me.name
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          "app.kubernetes.io/name"     = "coder-workspace"
+          "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+          "app.kubernetes.io/part-of"  = "coder"
+          "com.coder.resource"         = "true"
+          "com.coder.workspace.id"     = data.coder_workspace.me.id
+          "com.coder.workspace.name"   = data.coder_workspace.me.name
+          "com.coder.user.id"          = data.coder_workspace_owner.me.id
+          "com.coder.user.username"    = data.coder_workspace_owner.me.name
+        }
+      }
+      spec {
+        # archlinux image has no UID-1000 workspace user; pod runs as root for pacman bootstrap.
+        # NFS home volume: prefer UID/GID 1000 on the share; startup_script chowns when permitted.
+        security_context {
+          run_as_user     = 0
+          run_as_non_root = false
+        }
+
+        container {
+          name              = "dev"
+          image             = "docker.io/archlinux:latest"
+          image_pull_policy = "Always"
+          command           = ["sh", "-c", coder_agent.main.init_script]
+          security_context {
+            run_as_user = "0"
+          }
+          env {
+            name  = "CODER_AGENT_TOKEN"
+            value = coder_agent.main.token
+          }
+          resources {
+            requests = {
+              "cpu"    = "250m"
+              "memory" = "512Mi"
+            }
+            limits = {
+              "cpu"    = "${data.coder_parameter.cpu.value}"
+              "memory" = "${data.coder_parameter.memory.value}Gi"
+            }
+          }
+          volume_mount {
+            mount_path = "/home/coder"
+            name       = "home"
+            read_only  = false
+          }
+          volume_mount {
+            mount_path = "/mnt/coder-tool-config"
+            name       = "tool-config"
+            read_only  = false
+          }
+        }
+
+        volume {
+          name = "home"
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim_v1.home.metadata.0.name
+            read_only  = false
+          }
+        }
+        volume {
+          name = "tool-config"
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim_v1.tool_shared_user[0].metadata[0].name
+            read_only  = false
+          }
+        }
+
+        affinity {
+          // This affinity attempts to spread out all workspace pods evenly across
+          // nodes.
+          pod_anti_affinity {
+            preferred_during_scheduling_ignored_during_execution {
+              weight = 1
+              pod_affinity_term {
+                topology_key = "kubernetes.io/hostname"
+                label_selector {
+                  match_expressions {
+                    key      = "app.kubernetes.io/name"
+                    operator = "In"
+                    values   = ["coder-workspace"]
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/templates/dkai-hermes/scripts/tool-shared-pvc-exists.sh b/templates/dkai-hermes/scripts/tool-shared-pvc-exists.sh
new file mode 100755
index 0000000..8f9fabf
--- /dev/null
+++ b/templates/dkai-hermes/scripts/tool-shared-pvc-exists.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+# Plan-time check: does coder-<owner-id>-tool-config PVC already exist?
+# Args: $1=namespace $2=pvc_name $3=use_kubeconfig(true|false) $4=kubeconfig path
+# Prints JSON: {"exists":"true"} or {"exists":"false"}
+# Exit 1 if existence cannot be determined (avoid silent wrong branch → AlreadyExists).
+set -eu
+NS=$1
+NAME=$2
+USE_KUBECONFIG=$3
+KUBECONFIG_PATH=$4
+
+# 1) In-cluster Kubernetes API (matches provider when use_kubeconfig is false)
+if [ -r /var/run/secrets/kubernetes.io/serviceaccount/token ] && [ -n "${KUBERNETES_SERVICE_HOST:-}" ]; then
+  if ! command -v curl >/dev/null 2>&1; then
+    echo "tool_shared_pvc_exists: in-cluster check needs curl in PATH" >&2
+    exit 1
+  fi
+  TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+  CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  PORT=443
+  [ -n "${KUBERNETES_SERVICE_PORT:-}" ] && PORT=${KUBERNETES_SERVICE_PORT}
+  API="https://${KUBERNETES_SERVICE_HOST}:${PORT}"
+  URL="${API}/api/v1/namespaces/${NS}/persistentvolumeclaims/${NAME}"
+  CODE=$(curl -sS -o /dev/null -w '%{http_code}' --cacert "$CA" -H "Authorization: Bearer $TOKEN" "$URL" || echo "000")
+  case "$CODE" in
+    200) echo '{"exists":"true"}'; exit 0 ;;
+    404) echo '{"exists":"false"}'; exit 0 ;;
+    000)
+      echo "tool_shared_pvc_exists: curl failed calling Kubernetes API" >&2
+      exit 1
+      ;;
+    *)
+      echo "tool_shared_pvc_exists: unexpected HTTP ${CODE} from ${URL} (need get on persistentvolumeclaims)" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+# 2) Host kubeconfig / kubectl
+if command -v kubectl >/dev/null 2>&1; then
+  if [ "$USE_KUBECONFIG" = "true" ] && [ -f "$KUBECONFIG_PATH" ]; then
+    export KUBECONFIG="$KUBECONFIG_PATH"
+  fi
+  if kubectl get pvc -n "$NS" "$NAME" >/dev/null 2>&1; then
+    echo '{"exists":"true"}'
+  else
+    echo '{"exists":"false"}'
+  fi
+  exit 0
+fi
+
+echo "tool_shared_pvc_exists: need in-cluster ServiceAccount + curl, or kubectl in PATH" >&2
+exit 1
diff --git a/templates/dkai-hermes/terraform.tfvars b/templates/dkai-hermes/terraform.tfvars
new file mode 100644
index 0000000..0533440
--- /dev/null
+++ b/templates/dkai-hermes/terraform.tfvars
@@ -0,0 +1 @@
+namespace = "coder-workspaces"