chat(devnet-6): enable panda-chat AI chat for glamsterdam-devnet-6

ansible/inventories/devnet-6/group_vars/all/chat.yaml

@@ -0,0 +1,26 @@
+# AI chat (panda-chat) — glamsterdam-devnet-6.
+# role: ethpandaops.general.generate_kubernetes_config
+#
+# Prereqs (shared with the bal-devnet-7 pilot; central, not per-devnet):
+#   - `chat` section in services.enc.yaml with llm_api_key,
+#     langfuse_public_key, langfuse_secret_key, and (panda on) the Authentik
+#     service-account panda_bot_username / panda_bot_token.
+#   - Cloudflare Access guard: the wildcard chat.*.ethpandaops.io app in
+#     ethPandaOps/cloudflare/terraform/chat.tf (allow: Ethereum Github Org).
+#     Trusted-header SSO is on by default (chat_auth_enabled).
+#   - hermes-agent-panda image with the dispatch entrypoint (panda-chat chart
+#     >= 0.2.0 runs the two-container pod) and panda >= 0.32.0.
+
+gen_kubernetes_config_chat_enabled: true
+# Pinned image: CI publishes to GHCR (private) and mirrors to Docker Hub.
+# <base>-<chat repo git sha>.
+gen_kubernetes_config_chat_image: "ethpandaops/chat:hermes-agent-panda-2026.6.5-20c0647"
+gen_kubernetes_config_chat_chart_version: "0.3.0"
+# services.enc.yaml#chat llm_api_key is an OpenRouter key (sk-or-v1-...).
+gen_kubernetes_config_chat_llm_provider: "openrouter"
+gen_kubernetes_config_chat_llm_api_key_env: "OPENROUTER_API_KEY"
+gen_kubernetes_config_chat_llm_model: "anthropic/claude-sonnet-4.6"
+# Panda on: renders the panda-server sidecar and seeds the panda CLI config
+# (/opt/data/.config/panda/config.yaml -> local server). Reuses the central
+# Authentik panda-chat service account + services.enc.yaml#chat panda_bot_*.
+gen_kubernetes_config_chat_panda_enabled: true

kubernetes/devnet-6/chat/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

kubernetes/devnet-6/chat/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: panda-chat
+  repository: https://ethpandaops.github.io/ethereum-helm-charts
+  version: 0.3.0
+digest: sha256:bd206f3456227a3466c0f3996526cccbdcb63f7df44d5b7cd312762477eea1d2
+generated: "2026-06-11T17:16:01.248748594+02:00"

kubernetes/devnet-6/chat/Chart.yaml

@@ -0,0 +1,11 @@
+# Ansible managed. Don't change this file manually. Template info: /vendor/collections/ansible_collections/ethpandaops/general/roles/generate_kubernetes_config/templates/Chart.yaml.j2
+
+apiVersion: v2
+name: chat
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+dependencies:
+  - name: panda-chat
+    repository: https://ethpandaops.github.io/ethereum-helm-charts
+    version: 0.3.0

kubernetes/devnet-6/chat/values.yaml

@@ -0,0 +1,88 @@
+# Ansible managed. Don't change this file manually. Template info: /vendor/collections/ansible_collections/ethpandaops/general/roles/generate_kubernetes_config/templates/chat.yaml.j2
+# Everything nests under the dependency chart's name — the generated wrapper
+# chart (Chart.yaml.j2) has no templates of its own, so top-level values
+# never reach the panda-chat subchart.
+panda-chat:
+  fullnameOverride: chat
+
+  network: glamsterdam-devnet-6
+  chainId: "7052886157"
+
+  image:
+    repository: ethpandaops/chat
+    tag: hermes-agent-panda-2026.6.5-20c0647
+    pullPolicy: IfNotPresent
+
+  llm:
+    provider: openrouter
+    model: anthropic/claude-sonnet-4.6
+    apiKeyEnv: OPENROUTER_API_KEY
+
+  # Override the chart's default prompt (panda-chat values.yaml). Pilot override
+  # ahead of an ansible/chart bump; mirrors ethereum-helm-charts panda-chat 0.3.x.
+  # Debugging-oriented: names the devnet's active forks so the agent reads
+  # symptoms under the right protocol model, and points at panda's canonical
+  # debugging procedure (the panda skill carries the detailed playbook).
+  systemPrompt: |
+    You are the EthPandaOps debugging assistant for the Ethereum devnet "glamsterdam-devnet-6" (chain id 7052886157), scoped to it alone. It runs Fulu/PeerDAS from genesis and Gloas/ePBS from epoch 30 — be fork-aware: missing-payload, PTC, and data-column symptoms are normal protocol artifacts here unless evidence says otherwise.
+    Tools: `panda` (query + debug live chain data, container logs, and nodes; its skill carries the panda debugging playbook), `faucet` (fund accounts), `join-devnet` (join the network).
+    To debug, follow panda's procedure: read `networks://glamsterdam-devnet-6` for fork context, then `runbooks://debug_devnet`. Discover before querying; never invent APIs, tables, or node names.
+    Report exactly what the tools return — paste raw output, cite the panda command behind each finding, and flag any disagreement between sources. Lead with the numbers, in plain English. Be concise.
+
+  # Panda integration (panda-server sidecar + Authentik bot identity). Off =
+  # plain LLM chat; the bot credentials are only referenced when on, so the
+  # devnet can run chat before services.enc.yaml#chat has panda_bot_* keys.
+  panda:
+    enabled: true
+
+  # LLM-call tracing → EthPandaOps Langfuse (keys from services.enc.yaml#chat).
+  langfuse:
+    enabled: true
+    baseUrl: "https://langfuse.analytics.production.platform.ethpandaops.io"
+
+  devnetTools:
+    faucet:
+      enabled: true
+      url: "https://faucet.glamsterdam-devnet-6.ethpandaops.io"
+    join:
+      configUrl: "https://config.glamsterdam-devnet-6.ethpandaops.io"
+      rpcUrl: "https://rpc.glamsterdam-devnet-6.ethpandaops.io"
+      explorerUrl: "https://dora.glamsterdam-devnet-6.ethpandaops.io"
+
+  credentials:
+    # Stable OW<->Hermes bearer: the chart can't preserve a generated one under
+    # ArgoCD (client-side `helm template`), so it must be a fixed sops value.
+    apiServerKey: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.api_server_key}>"
+    llmApiKey: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.llm_api_key}>"
+    panda:
+      botUsername: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.panda_bot_username}>"
+      botToken: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.panda_bot_token}>"
+    langfuse:
+      publicKey: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.langfuse_public_key}>"
+      secretKey: "<path:/secrets/services/services.enc.yaml#chat | jsonPath {.langfuse_secret_key}>"
+
+  open-webui:
+    sso:
+      enabled: true
+      trustedHeader:
+        enabled: true
+    openaiBaseApiUrls:
+      - "http://chat-hermes:8642/v1"
+    extraEnvVars:
+      - name: ENABLE_OLLAMA_API
+        value: "false"
+      - name: ENABLE_LOGIN_FORM
+        value: "false"
+      - name: OPENAI_API_KEYS
+        valueFrom:
+          secretKeyRef:
+            name: chat-hermes-secret
+            key: API_SERVER_KEY
+    ingress:
+      host: chat.glamsterdam-devnet-6.ethpandaops.io
+      annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "0"
+        nginx.ingress.kubernetes.io/configuration-snippet: |
+          sub_filter '</head>' '<script src="https://pandamenu.ethpandaops.io/panda-menu-1.0.1.js" integrity="sha384-icGX6g6CzB0tqlhDc6Su4c6IPVbcbUvfM3xjbbFYsYBwuZR79WkmOxDhGEPfmyn2" crossorigin="anonymous"></script></head>';
+          sub_filter_types text/html;
+          sub_filter_once off;