C4Context
  title Hermes Agent — System Context

  Person(user, "Family Member", "Sends messages via Signal/Telegram. Opens IDE in browser.")
  System(hermes, "Hermes Agent Pod", "Per-user AI agent running on the homelab cluster")
  System(dev, "Hermes Dev Pod", "VS Code browser IDE — separate lifecycle from agent")
  System_Ext(signal, "Signal Network", "Encrypted messaging transport")
  System_Ext(anthropic, "Anthropic API", "Claude LLM inference (billed per user)")
  System_Ext(github, "GitHub", "Source repos, PRs, Actions CI")
  System_Ext(google, "Google APIs", "Gmail, Calendar, Drive")
  System_Ext(ghcr, "GHCR", "ghcr.io/seadogger-tech/hermes-agent — custom image")
  System_Ext(dockerhub, "Docker Hub", "docker.io/nousresearch/hermes-agent — upstream base")
  System_Ext(appstore, "App Store Connect", "TestFlight uploads via fastlane + API key")
  System_Ext(gha_runners, "GitHub Actions macOS Runners", "Xcode build, sign, archive iOS .ipa")

  Rel(user, signal, "Sends message")
  Rel(signal, hermes, "JSON-RPC via signal-cli daemon")
  Rel(user, dev, "HTTPS — Web IDE (code.seadogger-homelab)")
  Rel(hermes, anthropic, "LLM API calls")
  Rel(hermes, github, "gh CLI — PRs, issues, Actions")
  Rel(hermes, google, "OAuth — Gmail, Calendar, Drive")
  Rel(hermes, gha_runners, "gh workflow run — triggers iOS build")
  Rel(gha_runners, appstore, "fastlane pilot — TestFlight upload")
  Rel(ghcr, hermes, "Pulls custom image on pod start")
  Rel(dockerhub, ghcr, "Upstream base — tracked by GHA workflow")

C4Container
  title Hermes Agent — Container View (single user, namespace: hermes-<user>)

  Person(user, "Family Member")

  Container_Boundary(cluster, "K3s Cluster — namespace: hermes-<user>") {
    Container(hermes_pod, "hermes pod", "ghcr.io/seadogger-tech/hermes-agent", "AI agent gateway. All dev tools baked in. Reads/writes /opt/data.")
    Container(dev_pod, "dev pod", "codercom/code-server", "VS Code browser IDE. Independent lifecycle. Reads/writes /opt/data.")
    Container(pvc, "hermes-data PVC", "CephFS RWM — ceph-fs-data-replicated 50Gi", "Shared RWM volume. Both pods mount simultaneously.")
    Container(sa_hermes, "ServiceAccount: hermes", "hermes-readonly by default. cluster-admin opt-in per overlay.", "Operator overlays explicitly bind cluster-admin. New users get read-only.")
    Container(sa_dev, "ServiceAccount: dev", "No cluster permissions", "IDE needs no cluster access — it works through the shared filesystem.")
  }

  Container_Boundary(signal_ns, "namespace: signal-cli") {
    Container(signal_cli, "signal-cli daemon", "Java / AsamK", "Signal JSON-RPC server. ClusterIP :8080.")
  }

  Container_Boundary(traefik_ns, "namespace: traefik") {
    Container(traefik, "Traefik", "IngressController", "hermes.* → :9119, code.* → :8080")
  }

  Container_Boundary(github_ext, "GitHub") {
    Container(gha, "GitHub Actions", "upstream-rebuild-hermes.yaml", "Polls upstream digest every 6h. Rebuilds on change.")
    Container(ghcr, "GHCR", "ghcr.io/seadogger-tech/hermes-agent", "Custom image with all dev tools + Swift compiler.")
  }

  Rel(user, traefik, "HTTPS hermes.seadogger-homelab")
  Rel(user, traefik, "HTTPS code.seadogger-homelab")
  Rel(traefik, hermes_pod, "HTTP :9119")
  Rel(traefik, dev_pod, "HTTP :8080")
  Rel(hermes_pod, pvc, "ReadWriteMany /opt/data")
  Rel(dev_pod, pvc, "ReadWriteMany /opt/data")
  Rel(hermes_pod, signal_cli, "JSON-RPC :8080")
  Rel(gha, ghcr, "docker buildx push arm64")
  Rel(ghcr, hermes_pod, "imagePull on rollout")

C4Component
  title Hermes Image Build Pipeline

  Container_Boundary(pro_repo, "seadogger-homelab-pro (GitHub)") {
    Component(dockerfile, "deployments/hermes/Dockerfile", "Dockerfile", "FROM upstream. Installs all tools, Swift compiler, dev runtimes.")
    Component(workflow, ".github/workflows/upstream-rebuild-hermes.yaml", "GitHub Actions", "Polls Docker Hub digest every 6h. Rebuilds on upstream change.")
    Component(digest_file, ".github/hermes_upstream_digest", "Text file", "Last-built upstream digest. Committed by CI.")
    Component(deployment_yaml, "deployments/hermes/base/deployment.yaml", "K8s manifest", "Image tag pinned here. AUTO_BUMP_TAG workflow input controls auto-update.")
  }

  Container_Boundary(registries, "Container Registries") {
    Component(dockerhub, "docker.io/nousresearch/hermes-agent", "Docker Hub", "Upstream. NousResearch publishes arm64 + amd64.")
    Component(ghcr_img, "ghcr.io/seadogger-tech/hermes-agent", "GHCR", "Custom image with full dev tooling baked in.")
  }

  Container_Boundary(cluster, "K3s Cluster") {
    Component(argocd, "ArgoCD", "GitOps", "Watches deployment.yaml for image tag changes")
    Component(pod, "hermes pod", "Running container", "Pulls from GHCR on start")
  }

  Rel(workflow, dockerhub, "Polls digest via Docker Hub API every 6h")
  Rel(workflow, digest_file, "Read/write last digest")
  Rel(workflow, dockerfile, "docker buildx build on change")
  Rel(dockerfile, dockerhub, "FROM upstream base")
  Rel(workflow, ghcr_img, "docker buildx push linux/arm64")
  Rel(workflow, deployment_yaml, "Bumps image tag if AUTO_BUMP_TAG=true")
  Rel(argocd, deployment_yaml, "Reconciles on commit")
  Rel(pod, ghcr_img, "imagePull on rollout")