Merge pull request 'fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit' (#19 ) from fix/nix-gc-github-rate-limit into main

Reviewed-on: #19
fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit
2026-10-05 14:37:46 +02:00 · 2026-10-05 14:35:19 +02:00 · 2026-10-04 18:39:52 +02:00 · 2026-10-04 18:37:36 +02:00 · 2026-10-04 18:36:35 +02:00 · 2026-09-29 17:36:18 +02:00
6 changed files with 45 additions and 28 deletions
@@ -21,11 +21,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1788450739,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "lastModified": 1790898470,
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
        "type": "github"
      },
      "original": {
@@ -113,11 +113,11 @@
        "uv2nix": "uv2nix"
      },
      "locked": {
-        "lastModified": 1789999030,
-        "narHash": "sha256-oqEWD3Ih/CDejvfWNXFhbwUxvU4RwQZQ9DrI5dD+P10=",
+        "lastModified": 1791121781,
+        "narHash": "sha256-39vzOiYTAwECDMfJAv/b+OxpHPXHfJle0Gx5x+WjPW0=",
        "owner": "NousResearch",
        "repo": "hermes-agent",
-        "rev": "8f7b3b48fc61dc411cac6ebcb0aaaf451ba9c1cb",
+        "rev": "af90026aa09949579bd423d24def3d38f743cde0",
        "type": "github"
      },
      "original": {
@@ -157,11 +157,11 @@
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1789933661,
-        "narHash": "sha256-GtfSaYgUPu91AafiBAQIVEwQiPfIOrgqwmxGtMNDtMI=",
+        "lastModified": 1791067591,
+        "narHash": "sha256-SGcfVVSS3DLO+ES4J+SrLxKGP11yvTWXgiAqku1L+Sk=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "5711f8fed2fcff91a52646e2e856648eca86c331",
+        "rev": "e8280775f307a94ca82cea193cfcc14c0d56232a",
        "type": "github"
      },
      "original": {
@@ -211,11 +211,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1789978172,
-        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
+        "lastModified": 1791128201,
+        "narHash": "sha256-rlsYY/Dg/LhbIj51Aa6TLvRpZeb3KZgUTd7llQ5XcJE=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
+        "rev": "31cc5f4d9b9ba601071e8b8504601b9b176e2756",
        "type": "github"
      },
      "original": {
@@ -255,11 +255,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1788057806,
-        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
+        "lastModified": 1790477367,
+        "narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b",
        "type": "github"
      },
      "original": {
@@ -286,11 +286,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1789921291,
-        "narHash": "sha256-uLLUj+TLUmBc6KrUzx76KZdPi5ZkI1ORR9A6lJUIZlo=",
-        "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4",
+        "lastModified": 1791048980,
+        "narHash": "sha256-u3KCLxsnf1622GdFccg8hmkEIutOZ1h4pvia5ERjIuI=",
+        "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077143.44a91898084f/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1084968.a7868a727837/nixexprs.tar.zst"
      },
      "original": {
        "id": "nixpkgs",
@@ -313,11 +313,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1789885152,
-        "narHash": "sha256-lIL3uDaS4Q9Ks6klLrBlDr+XS71sbjMJFSipIp2yPjs=",
-        "rev": "6d663c0533ff269008fb84e45930151e37c99db9",
+        "lastModified": 1791031588,
+        "narHash": "sha256-4XF6NXFWmQPM0xHuxTw+iQEA6mUtmDQNJoVd4u9GkLw=",
+        "rev": "825e2028c29b702a4a5f085f08095d12099784f2",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10304.6d663c0533ff/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11150.825e2028c29b/nixexprs.tar.zst"
      },
      "original": {
        "id": "nixpkgs",
@@ -415,11 +415,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789890976,
-        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
+        "lastModified": 1791103873,
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
        "type": "github"
      },
      "original": {
@@ -12,6 +12,13 @@

    settings = {
      auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
    };

    gc = {
@@ -72,6 +72,9 @@

  system = {
    stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
  };
 }
@@ -61,6 +61,9 @@

  system = {
    stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
  };
 }
@@ -4,5 +4,6 @@ _: {
  # firewall otherwise blocks inbound connections from other devices.
  networking.firewall.allowedTCPPorts = [
    9119 # athena hermes dashboard
+    47823 # hermes agent ad-hoc webpage server
  ];
 }
@@ -20,6 +20,9 @@ in
      enable = true;
      # Deliberate pin, matches the approved design — bump on purpose, not by drift.
      settings.model.default = "anthropic/claude-sonnet-4-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
      environmentFiles = [ config.sops.secrets."hermes-env".path ];
      addToSystemPackages = true;
Author	SHA1	Message	Date
finn.markwitz	3f48c0400b	Merge pull request 'fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit' (#19 ) from fix/nix-gc-github-rate-limit into main Reviewed-on: #19	2026-10-05 14:37:46 +02:00
finn.markwitzandClaude Sonnet 5	4de92dcbe8	fix(nix): stop automatic rebuilds and nightly GC from tripping GitHub's rate limit autoUpgrade was silently failing daily on both hosts (legacy channel path, no --flake set) without reaching the network — disabled outright since rebuilds should only happen manually. Separately, nix-gc.timer's nightly sweep was deleting eval-time-only flake input sources (not part of the runtime closure), forcing the next evaluation to cold-refetch hermes-agent's entire dependency tree from GitHub in one burst, which alone was enough to hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations stop GC from evicting those sources. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF	2026-10-05 14:35:19 +02:00
finn.markwitz	f7196c0c86	chore: Flake Update	2026-10-04 18:39:52 +02:00
finn.markwitz	20c2b43ae5	Merge pull request 'Feat/hermes webpage port' (#17 ) from feat/hermes-webpage-port into main Reviewed-on: #17	2026-10-04 18:37:36 +02:00
finn.markwitz	eecb7fa2b2	Merge pull request 'Feat/jupiter seerr rename' (#16 ) from feat/jupiter-seerr-rename into feat/hermes-webpage-port Reviewed-on: #16	2026-10-04 18:36:35 +02:00
finn.markwitzandClaude Sonnet 5	84ada68069	fix(mibook): disable hermes-agent's built-in self-update GitHub polling Its self-updater was independently polling GitHub for the same repo the flake input tracks, and stacked with a runaway crash-restart loop this exhausted the GitHub rate limit, causing unrelated flake fetches to 429. The Nix flake input is already the source of truth for hermes's version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3	2026-09-29 17:36:18 +02:00
finn.markwitz	07a1d8ee62	feat(mibook): open port 47823 for hermes ad-hoc webpage hosting Distinct from the existing 9119 dashboard port — this lets the agent serve one-off pages to devices on the local network.	2026-09-26 08:15:58 +02:00