From 4a260ae7d7d217ab9a046dcc3b03cbe1b5a721d3 Mon Sep 17 00:00:00 2001
From: Mikei386 <44135113+Mikei386@users.noreply.github.com>
Date: Tue, 25 Aug 2026 10:25:52 +0200
Subject: [PATCH] Make Hermes secret permissions idempotent

---
 platform/hermes/install-hermes.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/platform/hermes/install-hermes.sh b/platform/hermes/install-hermes.sh
index 25a0949..985e8b0 100755
--- a/platform/hermes/install-hermes.sh
+++ b/platform/hermes/install-hermes.sh
@@ -18,9 +18,15 @@ install -d -m 0750 "$HERMES_DATA_DIR/workspace"
 [[ -s $SECRETS_DIR/hermes-api-key ]] || openssl rand -base64 48 >"$SECRETS_DIR/hermes-api-key"
 [[ -s $SECRETS_DIR/hermes-dashboard-password ]] || openssl rand -base64 24 >"$SECRETS_DIR/hermes-dashboard-password"
 [[ -s $SECRETS_DIR/hermes-dashboard-secret ]] || openssl rand -base64 48 >"$SECRETS_DIR/hermes-dashboard-secret"
-chmod 0600 "$SECRETS_DIR/hermes-api-key" \
+for secret in \
+  "$SECRETS_DIR/hermes-api-key" \
   "$SECRETS_DIR/hermes-dashboard-password" \
-  "$SECRETS_DIR/hermes-dashboard-secret"
+  "$SECRETS_DIR/hermes-dashboard-secret"; do
+  # The Athena operator receives /etc/mike-ai read-only. A managed secret that
+  # is already mode 0600 needs no write at all, which keeps this installer
+  # safely idempotent both interactively and through the operator.
+  [[ $(stat -c '%a' "$secret") == 600 ]] || chmod 0600 "$secret"
+done
 
 router_key=$(<"$SECRETS_DIR/router-api-key")
 mua_url=http://127.0.0.1:9/mcp