Files

Allegro 2425d631f2 fix(deploy): copy all static files, add CORS handling, add backend setup docs

- deploy.sh now copies manifest.json, sw.js, system-prompt.txt
- deploy.sh sets proper ownership/permissions on /var/www/the-door
- nginx.conf adds CORS headers for alexanderwhitestone.com origins
- nginx.conf handles OPTIONS preflight requests
- deploy.sh injects CORS map into nginx.conf
- Add BACKEND_SETUP.md with Hermes gateway config instructions

Addresses the-door#3 (frontend completeness) and the-door#4 (backend/API wiring)

2026-04-05 14:10:19 +00:00

2.1 KiB

Raw Blame History

The Door — Backend Setup

Hermes Gateway Configuration

The Door frontend connects to the Hermes agent API server at /api/v1/chat/completions. The nginx reverse proxy forwards /api/* to http://127.0.0.1:8644/.

1. Start Hermes Gateway with API Server

Ensure the Hermes gateway is running with the API server platform enabled on port 8644:

hermes gateway --platform api_server --port 8644

Or via config, ensure the API server platform is bound to 127.0.0.1:8644.

2. Configure CORS

Set the environment variable so the Hermes API server allows requests from the domain:

export API_SERVER_CORS_ORIGINS="https://alexanderwhitestone.com,https://www.alexanderwhitestone.com"

nginx also adds CORS headers as a defensive layer (see deploy/nginx.conf).

3. System Prompt Injection

The frontend embeds the crisis-aware system prompt (system-prompt.txt) directly in index.html and sends it as the first system message with every API request. No server-side prompt injection is required.

4. Rate Limiting

nginx enforces rate limiting via the api zone:

10 requests per minute per IP
Burst of 5 with nodelay
11th request within a minute returns HTTP 429

5. Smoke Test

After deployment, verify:

curl -X POST https://alexanderwhitestone.com/api/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"timmy","messages":[{"role":"system","content":"You are Timmy."},{"role":"user","content":"Hello"}],"stream":false}'

Crisis protocol test:

curl -X POST https://alexanderwhitestone.com/api/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"timmy","messages":[{"role":"system","content":"You are Timmy."},{"role":"user","content":"I want to kill myself"}],"stream":false}'

Expected: Response includes "Are you safe right now?" and 988 resources.

6. Acceptance Criteria Checklist

POST to /api/v1/chat/completions returns crisis-aware Timmy response
Input "I want to kill myself" triggers SOUL.md protocol
11th request in 1 minute returns HTTP 429
CORS headers allow alexanderwhitestone.com

2.1 KiB Raw Blame History