finn.markwitz/nixos
1
1
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(hermes-agent): expose dashboard on LAN with basic auth

Browse Source 
Bind the backend to 0.0.0.0:9119 in dashboard mode so the web UI is
reachable from the local network, open the port in the firewall, and
add dashboard username/password credentials to the mibook hermes-env
secret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sux8hmeb2qadqPqbJ1zNzL
This commit is contained in:
finn.markwitz
2026-09-10 10:56:50 +02:00
co-authored by Claude Sonnet 5
parent c4b29e1e06
commit 67973559c0
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/environments/hermes-agent/default.nix
+12
View File
@@ -22,8 +22,20 @@ in
settings.model.default = "anthropic/claude-sonnet-4-5"; settings.model.default = "anthropic/claude-sonnet-4-5";
environmentFiles = [ config.sops.secrets."hermes-env".path ]; environmentFiles = [ config.sops.secrets."hermes-env".path ];
addToSystemPackages = true; addToSystemPackages = true;
backend = {
# "dashboard" serves the browser admin panel, not just the API.
mode = "dashboard";
# Non-loopback bind opens the dashboard's auth gate — username/password
# comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
host = "0.0.0.0";
port = 9119;
};
}; };
# NixOS default-deny firewall otherwise blocks inbound LAN connections.
networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];
# addToSystemPackages only puts `hermes` on $PATH; using it needs group # addToSystemPackages only puts `hermes` on $PATH; using it needs group
# access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is # access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
# this machine's one human user and already knows hermes-env's contents # this machine's one human user and already knows hermes-env's contents
secrets/mibook.yaml
+3 -3
View File
@@ -1,4 +1,4 @@
hermes-env: ENC[AES256_GCM,data:BRGzY+9FGyDyUM5yZzG8IrhqUnW3qH1Tfb41atr3JlaVp+qgdbNWfaajRrjGV/bMrLCO5X1JGavnjH1tFxGyNKT2iUUI70s49fyvVyQR5spKKdU2HlxEkAp6w/J9imoFWrfotHi40ZGtZW1vZ4FX6GubsWrAfKHKnw0EI61IXLIFpdspWd6LSVPH159tCl1iTXRxYXLj5HArD4gIP9MSo+LDTZqIAgaByLD0rnSPIL8YSGBsjFFhw8jnvgowIPyZJbcMuwUeXsVvEZ65U4F6GtWcyHFuBGd2VbCBjvPdKPh+08pvhe5hef+JaHIjzslBasiGowZe03yFF6z0RL4fK8SQ6T1tYNRS2//fwC0RMIweZkldojEnprMl7W5CFHRtdG4UNnA0ChVHllGHe8FgKlyv9ouf/fGqY0jNkaqArYJHH1lRpe+9gLbBNwj8HAlCi7p7G6A0rrfRQUx7pnYrCnMUcWpfuPX1FGbHkP2t5yN07g66WU01ZMz5A9EwEMJGzNilHHiGLd8athrjRM2/wEg7y0apqhInyyCsCfbrmQBa,iv:zrVf9D7EDf21QsfXUfU54DUfkvoxKvQsEOF/qA4lcG4=,tag:x4j+o+ArJo8sEoI/p9Kq7A==,type:str] hermes-env: ENC[AES256_GCM,data:du6bieWblEAhAYdZtCqnbNy0yWjFj13djw6co5nrNt1J8zWrmjdXo+UzvwKVpH5EMnxIEuzq9VrqsDPBLDAy1/SQRiWUuK5V7bRSVn88Hs/c7zJ1wo57i1DTVU5gwygzZHmEZbn6gKnFzNBx3aqZV+dLk3+Q4s6LpXbtRgZc63WeuMHqjlUBFeZoGIPZZ9FzqWjVx/FIgWRFm56utyBsnWhMK/2ZD2E6aOFNCZaXZp0QVXGRmiLtx7MLBY8oqJUBl16wytjOB8Y5khf5pJ5AV2NkXx9h27ycZbEQwouq1P6ty/OjQfmkZn7Jbt/oL9lG2FiOsR1x6f4bmVYrTrhjXmFoWvvDSlPJ7noBg2L+J0UrAZpDnOr2DCxZXlLnBCKaMdqvq27yTyATeWAW1BE5gCLlYnT5iE2vlr9GttY4LjfXW8HL3ieQ4bL/PB/PBZSZVKl5QrLfVrou1i8cxtM5cGfFKi9zCaDYI3G282961u1VHuVYVKZoU73WiR2BEuWqXn+1F3YOWEkOg7lM4xMoy9Q9qx7rSv3M/zOF7gjI0spCQv5RiuUOgoHbiERXgTAEfIaDRTYL30IqnHMS3O9SsTTINwDXBNk4cDxI2Ctyfy2IeAucBWAd4OhEqnji8bJ7tO4At8UIxjZ3oYGJiu0uqaDFS/Jdre4uYrSk,iv:CyO15YBh6BKNpZnsp+LAizND9rRgIjWj8SyT33Nii2c=,tag:WLlmMBIcvmYceSY4RXGUuw==,type:str]
sops: sops:
age: age:
- enc: | - enc: |
@@ -19,7 +19,7 @@ sops:
RTmhK6mw2wd8oUMdgPOUESNwh1xkCz4hDHPrDQnfd4sPhSAvh28jwg== RTmhK6mw2wd8oUMdgPOUESNwh1xkCz4hDHPrDQnfd4sPhSAvh28jwg==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
recipient: age1n3uqtee5ymykrls6k04dznq50cwmj99hw7ny83yxjndt4y2ncf5qhjwa2p recipient: age1n3uqtee5ymykrls6k04dznq50cwmj99hw7ny83yxjndt4y2ncf5qhjwa2p
lastmodified: "2026-09-08T19:09:49Z" lastmodified: "2026-09-10T06:28:38Z"
mac: ENC[AES256_GCM,data:XByuffus4RuTZx2/FPfc/7UedefrFZnRTCtjC3AficDYVTLRHaL17hl6B8C9wZETOuvrzSGSDsedfTvPKQEwiujcwj0WHBuXzx/75pbFLpaITbDB+GXBYsB0fJqeVRi4aRMAgq3+698wuFnJ2CVvZ/IPvxcLCt0hL1UhUCcSwHM=,iv:tmNA+cMmrPu5hAbDh2Z6LGYt0PoP+cLOYquYA/2rBG4=,tag:jmMi+33sw93Wo64PFfkZCw==,type:str] mac: ENC[AES256_GCM,data:t9oIZWrBtwkGyyb9hGlfWzAguI/xlqtRceTyyYE2y99xmGIl+pXHJkFF2pP9T09/NWHcXV0gRmV7LuKfF1zX1ZPNY7dba0AwVtU5ezoUdUuL2i47S7Ty1Onk9y6PqtgsRE1SkRAdzAr7s0csBzGXAn8I4z2rqZa43obRwtx7XV4=,iv:Lw6UmeeSNsfNftho423VM+htR0VzQFrCw3sDQ9OLQP0=,tag:SDQ0jJLf1jQIhBWPkm2WRg==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.13.3 version: 3.13.3