feat(dkai-hermes): Hermes controller for remote Enodios vLLM

.cursor/rules/project.mdc

@@ -7,16 +7,16 @@ alwaysApply: true
 
 Terraform-based Coder workspace templates for DataKnife.
 
-- **Templates**: `templates/kubernetes/`, `templates/dkai-dev/`, `templates/dkai-arch/`, `templates/dkai-agent/`
-- **DKAI naming**: Coder **display name** = `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent); **internal ID** = `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`). Template icons: DevPod `k8s.svg`, Arch `cursor.svg`, Agent `k8s.svg` (distinct roles in the UI).
+- **Templates**: `templates/kubernetes/`, `templates/dkai-dev/`, `templates/dkai-arch/`, `templates/dkai-agent/`, `templates/dkai-hermes/`
+- **DKAI naming**: Coder **display name** = `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent, DKAI Hermes); **internal ID** = `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes`). Template icons: DevPod `k8s.svg`, Arch `cursor.svg`, Agent/Hermes `k8s.svg` (distinct roles in the UI).
 - **Validation**: `make test` (init, validate, fmt-check)
 - **Docs**: `docs/build-parameters.md` — Coder parameter reference
 - **CI**: GitHub Actions + GitLab mirror; add new templates to `TEMPLATES` in Makefile and CI matrix
 - **Push templates (debug / testing)**:
   - **Always run from the repo root** and pass **`--directory templates/<template-id>`**. The CLI uploads the current directory by default; pushing from the repo root without `--directory` fails with *no [.tf .tf.json] files* because Terraform lives under `templates/<name>/`.
   - **Same flags as GitLab CI** (`.gitlab-ci.yml` `push-to-coder` job):  
     `coder templates push "<template-id>" --directory "templates/<template-id>" --activate=false -y`  
-    Loop over `kubernetes`, `dkai-dev`, `dkai-arch`, `dkai-agent` as in CI when you need everything.
+    Loop over `kubernetes`, `dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes` as in CI when you need everything.
   - **`--activate=false`** uploads a new version but does **not** make it the default. To test a workspace on that build: **`coder templates versions promote --template <id> --template-version <version_name> -O <org>`**, then **`coder update <workspace>`** (or rebuild from the UI). List versions with **`coder templates versions list <id>`**; pick the newest row or use JSON if needed.
   - **Optional Makefile helpers** (extra Terraform flags for non-interactive push): **`make template-push TEMPLATE=dkai-agent`** or **`make push-dkai-agent`** — same `--directory` idea with absolute paths, `terraform.tfvars`, `--ignore-lockfile`, `-O coder`.
   - **Verify after deploy**: **`coder show <workspace>`** (agent healthy / startup), **`coder logs <workspace>`** (errors at end of startup), **`./scripts/coder-workspace-debug.sh <name>`** for a bundled grep. **`coder provisioner jobs list -l 10`** if a push sits silent (import still running).

.cursor/rules/terraform-coder.mdc

@@ -9,8 +9,8 @@ alwaysApply: false
 ## Project Context
 
 - Custom Coder workspace templates for DataKnife
-- **DKAI templates**: display name `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent); internal ID / directory `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`).
-- Templates: `kubernetes` (code-server), `dkai-dev` / `dkai-arch` / `dkai-agent` (Cursor CLI via startup script, no subdomain; Arch variants use `archlinux` image; `dkai-arch` uses `coder/cursor` module for Desktop button; `dkai-agent` omits that module, uses `coder_env` + end-of-startup script to auto-start `agent worker start` without `--pool` when `cursor_api_key` is set — individual account API key, not team pool)
+- **DKAI templates**: display name `DKAI <Template>` (e.g. DKAI DevPod, DKAI Arch, DKAI Agent, DKAI Hermes); internal ID / directory `dkai-<template>` (`dkai-dev`, `dkai-arch`, `dkai-agent`, `dkai-hermes`).
+- Templates: `kubernetes` (code-server), `dkai-dev` / `dkai-arch` / `dkai-agent` / `dkai-hermes` (Cursor CLI via startup script on dev/arch only; Arch variants use `archlinux` image; `dkai-arch` uses `coder/cursor` module for Desktop button; `dkai-agent` omits that module, uses `coder_env` + end-of-startup script to auto-start `agent worker start` without `--pool` when `cursor_api_key` is set; `dkai-hermes` Hermes controller only — remote Enodios vLLM at vllm.dataknife.net (Enodios not installed in workspace), no Cursor worker)
 - Validate with `make test` before committing
 
 ## Coder Provider

.github/workflows/ci.yaml

@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         # Add new template directories here when created
-        template: [kubernetes, dkai-dev, dkai-arch, dkai-agent]
+        template: [kubernetes, dkai-dev, dkai-arch, dkai-agent, dkai-hermes]
     steps:
       - name: Checkout
         uses: actions/checkout@v5

.gitlab-ci.yml

@@ -62,6 +62,12 @@ test:dkai-agent:
     TEMPLATE_NAME: dkai-agent
   # Startup shell is checked in test:dkai-arch (scripts/check-dkai-startup-shell.sh covers all Arch templates)
 
+test:dkai-hermes:
+  <<: *test_template
+  variables:
+    TEMPLATE_NAME: dkai-hermes
+  # Startup shell is checked in test:dkai-arch (scripts/check-dkai-startup-shell.sh covers all Arch templates)
+
 push-to-coder:
   stage: deploy
   tags:
@@ -72,13 +78,14 @@ push-to-coder:
     - test:dkai-dev
     - test:dkai-arch
     - test:dkai-agent
+    - test:dkai-hermes
   before_script:
     - apt-get update && apt-get install -y curl ca-certificates
     - curl -fsSL https://coder.dataknife.net/install.sh | sh -s --
     - coder version
   script:
     - |
-      for template in kubernetes dkai-dev dkai-arch dkai-agent; do
+      for template in kubernetes dkai-dev dkai-arch dkai-agent dkai-hermes; do
         if [ -d "templates/$template" ]; then
           echo "Pushing template: $template"
           coder templates push "$template" --directory "templates/$template" --activate=false -y

Makefile

@@ -4,7 +4,7 @@
 
 .NOTPARALLEL:
 
-TEMPLATES := kubernetes dkai-dev dkai-arch dkai-agent
+TEMPLATES := kubernetes dkai-dev dkai-arch dkai-agent dkai-hermes
 TERRAFORM := terraform
 
 # V=1 enables verbose/debug output
@@ -25,7 +25,7 @@ CODER_ORGANIZATION ?= coder
 # Kubernetes namespace for templates that define var.namespace (must match templates/<name>/terraform.tfvars)
 K8S_NAMESPACE ?= coder-workspaces
 
-.PHONY: test test-all fmt-check init validate clean fmt debug check-dkai-startup template-push push-dkai-agent
+.PHONY: test test-all fmt-check init validate clean fmt debug check-dkai-startup template-push push-dkai-agent push-dkai-hermes
 
 # Validate all templates (init, validate, format check)
 test: test-all
@@ -94,3 +94,6 @@ template-push:
 
 push-dkai-agent:
 	@$(MAKE) template-push TEMPLATE=dkai-agent MSG="$(MSG)"
+
+push-dkai-hermes:
+	@$(MAKE) template-push TEMPLATE=dkai-hermes MSG="$(MSG)"

README.md

@@ -14,6 +14,7 @@ This repository contains reusable Coder templates for provisioning development w
 | **DKAI DevPod** (`dkai-dev`) | Cursor IDE on Kubernetes (Ubuntu) — 2/4 CPU, 4/8 GB RAM, 50–100 GB disk (no subdomain required) |
 | **DKAI Arch** (`dkai-arch`) | Same as **DKAI DevPod** on **Arch Linux** (`archlinux` image, pacman, gh/glab from repos) |
 | **DKAI Agent** (`dkai-agent`) | **DKAI Arch** plus Cloud Agent worker (`start-cursor-worker`), second PVC for tool configs (`kubectl` / `rancher` / gh / glab), individual API key |
+| **DKAI Hermes** (`dkai-hermes`) | **Hermes Agent** controller → remote **[Enodios](https://github.com/DataKnifeAI/enodios) vLLM** (`vllm.dataknife.net`; Enodios does not run in the workspace) |
 
 ## References
 
@@ -76,7 +77,10 @@ coder-templates/
     ├── dkai-arch/
     │   ├── main.tf
     │   └── README.md
-    └── dkai-agent/
+    ├── dkai-agent/
+    │   ├── main.tf
+    │   └── README.md
+    └── dkai-hermes/
         ├── main.tf
         └── README.md
 ```

docs/build-parameters.md

@@ -25,4 +25,5 @@ Topics covered include:
 | DKAI DevPod (`dkai-dev`) | CPU (2/4 cores), Memory (4/8 GB), Home disk size (50–100 GB, monotonic ↑). Cursor IDE only (no subdomain). |
 | DKAI Arch (`dkai-arch`) | Same parameters as **DKAI DevPod** (`dkai-dev`). Arch Linux base image; Cursor IDE only (no subdomain). |
 | DKAI Agent (`dkai-agent`) | Same CPU/memory/home disk as DKAI Arch, plus **tool_config_disk_size** (default 5 GiB, 1–50 GiB) for the shared **ReadWriteMany** tool-config PVC at `/mnt/coder-tool-config` (one per Coder owner: `coder-<owner-id>-tool-config`; plan-time cluster check creates if missing else attaches). **cursor_worker_idle_timeout** (30–86400 s, default 600) for `agent worker start --idle-release-timeout`; optional **cursor_api_key** (masked; `CURSOR_API_KEY` via `coder_env`). |
+| DKAI Hermes (`dkai-hermes`) | Same as **DKAI Agent** (tool PVC, gh/glab/kubectl/rancher), but **Hermes Agent controller only** — **[Enodios](https://github.com/DataKnifeAI/enodios) vLLM runs remotely** (not in workspace). Hermes config points at **vllm_base_url** (default `https://vllm.dataknife.net/v1`), **vllm_model** (`hermes3:8b`), optional **vllm_api_key**; optional **hermes_worker_git_url** for project code. |
 | kubernetes| See [templates/kubernetes/README.md](../templates/kubernetes/README.md)   |

scripts/check-dkai-startup-shell.sh

@@ -6,6 +6,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 TEMPLATES=(
   dkai-arch
   dkai-agent
+  dkai-hermes
 )
 
 for name in "${TEMPLATES[@]}"; do

templates/dkai-hermes/README.md

@@ -0,0 +1,82 @@
+---
+display_name: DKAI Hermes
+description: Hermes Agent controller on Kubernetes — remote Enodios vLLM at vllm.dataknife.net
+icon: /icon/k8s.svg
+maintainer_github: coder
+verified: false
+tags: [kubernetes, container, archlinux, hermes, enodios, vllm, remote-llm]
+---
+
+# DKAI Hermes
+
+**Hermes Agent controller** on Kubernetes, wired to **remote [Enodios](https://github.com/DataKnifeAI/enodios) vLLM** at **`https://vllm.dataknife.net/v1`**.
+
+**Enodios does not run in this workspace.** Enodios is the remote inference stack (vLLM on GPU / DataKnife-hosted). This pod installs **Hermes only** and connects outbound over HTTPS. No `enodios install`, no local vLLM, no GPU required in the workspace.
+
+```
+You ──► Hermes Agent (this Coder workspace — tools, files, terminal)
+              │
+              │  OpenAI-compatible API
+              ▼
+         Remote Enodios vLLM (vllm.dataknife.net — outside workspace)
+```
+
+## What runs where
+
+| Component | Location | In workspace? |
+|-----------|----------|---------------|
+| **Enodios / vLLM** | GPU host or `vllm.dataknife.net` | **No** |
+| **Hermes Agent** | Coder workspace pod | **Yes** |
+| **Your code** | Optional git clone under `/home/coder/<repo>/` | **Yes** |
+
+## What you get
+
+- **`hermes` CLI** — agent with tools; config on tool PVC at `~/.hermes`.
+- **Remote vLLM parameters** — Hermes `custom_providers` block (Enodios layout) rewritten each start:
+  - **`vllm_base_url`** — default `https://vllm.dataknife.net/v1`
+  - **`vllm_model`** — default `hermes3:8b`
+  - **`vllm_api_key`** — optional, for authenticated endpoints
+- **`hermes_worker_git_url`** — optional project repo (default `agent-workspace`); not Enodios itself.
+- **`start-hermes-chat`** — `hermes chat` from cloned repo or `/home/coder`.
+- **Startup probe** — `GET <base-url>/models` reachability check.
+
+## Quick start
+
+1. Ensure remote Enodios vLLM is up at `vllm.dataknife.net` (or your `vllm_base_url`).
+2. Create workspace; confirm startup shows **vLLM reachability: ok**.
+3. Chat:
+
+   ```bash
+   start-hermes-chat
+   ```
+
+## Parameters
+
+| Parameter | Default | Notes |
+|-----------|---------|-------|
+| `vllm_base_url` | `https://vllm.dataknife.net/v1` | Remote Enodios endpoint (reachable from pods) |
+| `vllm_model` | `hermes3:8b` | Must match remote `/v1/models` |
+| `vllm_api_key` | (empty) | If remote vLLM requires auth |
+| `hermes_worker_git_url` | `agent-workspace` repo | Your project code — not Enodios |
+
+## Operating Enodios (remote)
+
+Enodios is managed on the inference side. See **[Enodios docs](https://dataknifeai.github.io/enodios/)** for GPU host setup (`enodios install`, `enodios start --lan`, etc.). Controllers (this template) only need Hermes pointed at the remote URL.
+
+## Relationship to DKAI Agent
+
+Same Kubernetes layout and CLI tooling (`gh`, `glab`, `kubectl`, `rancher`). Replaces Cursor Cloud Agent with **Hermes → remote Enodios vLLM**.
+
+Git / `gh` / `glab` shared paths: **[DKAI Agent README](../dkai-agent/README.md#git-gh--glab-and-home)**.
+
+## Debugging
+
+```bash
+coder ssh <workspace> -- sh -c 'cat /mnt/coder-tool-config/hermes/config.yaml'
+coder ssh <workspace> -- sh -c 'curl -fsS "https://vllm.dataknife.net/v1/models" | head -c 500'
+```
+
+## Related
+
+- [Enodios](https://github.com/DataKnifeAI/enodios) · [Docs](https://dataknifeai.github.io/enodios/) (remote inference stack)
+- [Hermes Agent](https://hermes-agent.nousresearch.com/)