dtoro
7712e957ed
Replace nomos with dsh (DeepSeek Harness) as the agent runtime per
plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5.
Deleted:
- cmd/nomos/ (agent loop, :8092 chat gateway, task tools, eval runner)
- nomos/ (SOUL.md, config.yaml, skills/)
- internal/nomos/{session,messagequeue,retrycap,turngate,assent}/
- compose/nomos/ Dockerfile + docker-compose nomos service
- httpapi /agent reverse-proxy mount (NOMOS_PROXY_URL)
- evals/*.yaml (nomos golden-conversation manifests)
- compose/caddy/Caddyfile.oikos nomos.hubris.network block + /agent path
- .golangci.yml nomos-isolation rules
- go.mod openai-go dependency (go mod tidy)
Kept:
- internal/adapters/postgres assent-window logic (governance port)
- OIKOS_NOMOS_AGENT_SLUG config (MCP agent entity attribution)
- Full REST API, MCP tools, policy, scheduler, secrets
Cleaned: deploy.sh image prune, verify-phase6.sh checks,
seed-secrets.sh key source, README/CONTRIBUTING/AGENTS.md docs.
Build, vet, test, compose config all pass.
55 lines
2.3 KiB
Caddyfile
55 lines
2.3 KiB
Caddyfile
# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
|
|
# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
|
|
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
|
|
# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
|
|
#
|
|
# The SPA lives in its own repo (dtoro/oikos-web) and deploys as its own
|
|
# compose project publishing mac-mini:8091 — see the docker-compose.yml
|
|
# comment. Every API/MCP route requires
|
|
# a bearer token in all cases (api's dev-open bypass was removed) —
|
|
# non-browser clients (Wails, curl, a future mobile client) can't complete
|
|
# Authentik's browser-session login, so those routes bypass `import
|
|
# authentik` the same way the enrollment endpoint always has and rely on
|
|
# api's own combinedAuth instead. See the Wails plan's "Plan review"
|
|
# section, gap 1.
|
|
#
|
|
# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
|
|
# rather than the mesh (netbird) hostname.
|
|
|
|
oikos.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
@enroll path /api/v1/clients/enroll /oidc-callback
|
|
handle @enroll {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
|
|
# is the real gate; Authentik would just reject non-browser callers
|
|
# before they ever get there, so /api/v1/* and /mcp bypass `import
|
|
# authentik` and rely on api's own combinedAuth.
|
|
@api path /api/v1/* /mcp
|
|
handle @api {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Everything else: the static SPA shell, served by the `web` container.
|
|
# No sensitive data lives here — real enforcement is the bearer-token
|
|
# check above — Authentik is just a first line of defense against
|
|
# anonymous crawlers finding the bundle.
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.178.182:8091
|
|
}
|
|
}
|
|
|
|
# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
|
|
# no separate gate here.
|
|
mcp.hubris.network {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
|
|
# nomos.hubris.network (the retired nomos gateway, :8092) was removed with
|
|
# the nomos decommission — plans/2026-08-16-dsh-as-agent-replace-nomos.md
|
|
# section 5. The agent runtime is dsh (external MCP client, no inbound
|
|
# gateway). Remember to mirror this removal in dtoro/caddy-conf.
|