feat: rôle hermes_user + ask-agent + skills délégation

- Nouveau rôle hermes_user : création user/group UID 1002 sur storage-01
  et gpu-01, sudoers limités par host, clé SSH ed25519 générée sur
  storage-01 et distribuée vers gpu-01, ssh_config + known_hosts
- Kubeconfig copié depuis ansible vers hermes sur storage-01
- ask-agent : script bash LiteLLM pour déléguer aux agents
  system/monitor/brain/funk-ai
- hermes-skills/funk/agent-delegation : skill Hermes pour les
  inter-profile calls avec pattern Terminal: ask-agent
- Playbooks storage-01 et gpu-01 : ajout du rôle hermes_user

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/hermes_user/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+hermes_user: hermes
+hermes_group: hermes
+hermes_uid: 1002
+hermes_gid: 1002
+hermes_home: /opt/hermes
+hermes_shell: /bin/bash
+hermes_ssh_key_type: ed25519
+hermes_ssh_key_comment: "hermes@funk-cluster"

ansible/roles/hermes_user/tasks/main.yml

@@ -0,0 +1,151 @@
+---
+# ── User creation (tous les hosts) ────────────────────────────────────────────
+
+- name: Create hermes group
+  ansible.builtin.group:
+    name: "{{ hermes_group }}"
+    gid: "{{ hermes_gid }}"
+    state: present
+
+- name: Create hermes user
+  ansible.builtin.user:
+    name: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    uid: "{{ hermes_uid }}"
+    home: "{{ hermes_home }}"
+    shell: "{{ hermes_shell }}"
+    create_home: true
+    state: present
+
+- name: Create .ssh directory for hermes
+  ansible.builtin.file:
+    path: "{{ hermes_home }}/.ssh"
+    state: directory
+    owner: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    mode: '0700'
+
+- name: Add hermes to systemd-journal group
+  ansible.builtin.user:
+    name: "{{ hermes_user }}"
+    groups: systemd-journal
+    append: true
+
+# ── Sudoers limité ─────────────────────────────────────────────────────────────
+
+- name: Allow hermes limited sudo on storage-01
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/hermes
+    content: |
+      # Hermes agent — monitoring local
+      hermes ALL=(ALL) NOPASSWD: /usr/sbin/smartctl *
+      hermes ALL=(ALL) NOPASSWD: /usr/bin/journalctl *
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+  when: inventory_hostname in groups['gateway']
+
+- name: Allow hermes limited sudo on gpu-01
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/hermes
+    content: |
+      # Hermes agent — GPU monitoring
+      hermes ALL=(ALL) NOPASSWD: /usr/bin/rocm-smi
+      hermes ALL=(ALL) NOPASSWD: /bin/systemctl status llama-server*
+      hermes ALL=(ALL) NOPASSWD: /usr/bin/journalctl *
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+  when: inventory_hostname in groups['gpu_hosts']
+
+# ── Génération clé SSH (storage-01 uniquement) ────────────────────────────────
+
+- name: Generate SSH key for hermes
+  ansible.builtin.user:
+    name: "{{ hermes_user }}"
+    generate_ssh_key: true
+    ssh_key_type: "{{ hermes_ssh_key_type }}"
+    ssh_key_file: ".ssh/id_{{ hermes_ssh_key_type }}"
+    ssh_key_comment: "{{ hermes_ssh_key_comment }}"
+  when: inventory_hostname in groups['gateway']
+
+- name: Read hermes public key
+  ansible.builtin.slurp:
+    src: "{{ hermes_home }}/.ssh/id_{{ hermes_ssh_key_type }}.pub"
+  register: hermes_pub_key
+  when: inventory_hostname in groups['gateway']
+
+# ── Distribution clé publique → gpu-01 ────────────────────────────────────────
+
+- name: Add hermes public key to gpu-01 authorized_keys
+  ansible.posix.authorized_key:
+    user: "{{ hermes_user }}"
+    key: "{{ hermes_pub_key.content | b64decode | trim }}"
+    state: present
+  delegate_to: "{{ item }}"
+  loop: "{{ groups['gpu_hosts'] }}"
+  when: inventory_hostname in groups['gateway']
+
+# ── SSH config + known_hosts (storage-01) ─────────────────────────────────────
+
+- name: Deploy SSH client config for hermes
+  ansible.builtin.template:
+    src: ssh_config.j2
+    dest: "{{ hermes_home }}/.ssh/config"
+    owner: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    mode: '0600'
+  when: inventory_hostname in groups['gateway']
+
+- name: Scan gpu-01 SSH host key
+  ansible.builtin.command:
+    cmd: "ssh-keyscan -t ed25519 {{ hostvars['gpu-01'].ansible_host }}"
+  register: gpu01_hostkey
+  changed_when: false
+  when: inventory_hostname in groups['gateway']
+
+- name: Add gpu-01 to hermes known_hosts
+  ansible.builtin.known_hosts:
+    name: "{{ hostvars['gpu-01'].ansible_host }}"
+    key: "{{ gpu01_hostkey.stdout }}"
+    path: "{{ hermes_home }}/.ssh/known_hosts"
+    state: present
+  when:
+    - inventory_hostname in groups['gateway']
+    - gpu01_hostkey.stdout | length > 0
+
+- name: Fix ownership of hermes .ssh directory
+  ansible.builtin.file:
+    path: "{{ hermes_home }}/.ssh"
+    state: directory
+    owner: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    recurse: true
+  when: inventory_hostname in groups['gateway']
+
+# ── kubeconfig pour kubectl (storage-01) ──────────────────────────────────────
+
+- name: Create .kube directory for hermes
+  ansible.builtin.file:
+    path: "{{ hermes_home }}/.kube"
+    state: directory
+    owner: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    mode: '0700'
+  when: inventory_hostname in groups['gateway']
+
+- name: Check if ansible kubeconfig exists
+  ansible.builtin.stat:
+    path: /home/ansible/.kube/config
+  register: ansible_kubeconfig
+  when: inventory_hostname in groups['gateway']
+
+- name: Copy kubeconfig to hermes home
+  ansible.builtin.copy:
+    src: /home/ansible/.kube/config
+    dest: "{{ hermes_home }}/.kube/config"
+    owner: "{{ hermes_user }}"
+    group: "{{ hermes_group }}"
+    mode: '0600'
+    remote_src: true
+  when:
+    - inventory_hostname in groups['gateway']
+    - ansible_kubeconfig.stat.exists

ansible/roles/hermes_user/templates/ssh_config.j2

@@ -0,0 +1,6 @@
+Host gpu-01
+    HostName {{ hostvars['gpu-01'].ansible_host }}
+    User {{ hermes_user }}
+    IdentityFile ~/.ssh/id_{{ hermes_ssh_key_type }}
+    StrictHostKeyChecking accept-new
+    ConnectTimeout 10