Fail closed when Hermes local config is unreadable

2026-08-24 17:15:15 +02:00
parent 348ca1324e
commit 8ef079d40e
5 changed files with 28 additions and 1 deletions
@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+
+config=/opt/data/config.yaml
+if [ ! -r "$config" ]; then
+  echo "HERMES_START_REFUSED: managed config is not readable" >&2
+  exit 78
+fi
+grep -Eq '^[[:space:]]+provider:[[:space:]]+["'\'']?custom["'\'']?[[:space:]]*$' "$config" || {
+  echo "HERMES_START_REFUSED: provider is not custom" >&2
+  exit 78
+}
+grep -Eq '^[[:space:]]+base_url:[[:space:]]+["'\'']?http://router:8081/v1["'\'']?[[:space:]]*$' "$config" || {
+  echo "HERMES_START_REFUSED: local router URL is missing" >&2
+  exit 78
+}
+
+exec hermes gateway run
+