Fail closed when Hermes local config is unreadable

platform/hermes/install-hermes.sh

@@ -55,4 +55,5 @@ if [[ -s $HERMES_DATA_DIR/config.yaml ]] && \
     "$HERMES_DATA_DIR/config.yaml.before-managed-update-$(date +%Y%m%d-%H%M%S)"
 fi
 install -m 0600 "$STACK_DIR/platform/hermes/config.yaml" "$HERMES_DATA_DIR/config.yaml"
+chown -R 10000:10000 "$HERMES_DATA_DIR"
 printf 'HERMES_CONFIG_OK %s\n' "$HERMES_DATA_DIR"

platform/hermes/start-hermes-managed.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+
+config=/opt/data/config.yaml
+if [ ! -r "$config" ]; then
+  echo "HERMES_START_REFUSED: managed config is not readable" >&2
+  exit 78
+fi
+grep -Eq '^[[:space:]]+provider:[[:space:]]+["'\'']?custom["'\'']?[[:space:]]*$' "$config" || {
+  echo "HERMES_START_REFUSED: provider is not custom" >&2
+  exit 78
+}
+grep -Eq '^[[:space:]]+base_url:[[:space:]]+["'\'']?http://router:8081/v1["'\'']?[[:space:]]*$' "$config" || {
+  echo "HERMES_START_REFUSED: local router URL is missing" >&2
+  exit 78
+}
+
+exec hermes gateway run
+