fix(mibook): disable hermes-agent's built-in self-update GitHub polling

Its self-updater was independently polling GitHub for the same repo the
flake input tracks, and stacked with a runaway crash-restart loop this
exhausted the GitHub rate limit, causing unrelated flake fetches to 429.
The Nix flake input is already the source of truth for hermes's version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3

flake.lock

@@ -63,11 +63,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788450739,
+        "lastModified": 1785627969,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -87,11 +87,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788267358,
+        "lastModified": 1784288435,
-        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "27555e2624241fb116b49095df4caaee85a25691",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1789999030,
+        "lastModified": 1789361774,
-        "narHash": "sha256-oqEWD3Ih/CDejvfWNXFhbwUxvU4RwQZQ9DrI5dD+P10=",
+        "narHash": "sha256-ashkMxyQelHq7T4AcJ0Zwuzm9/jMR3hTCWW+2FPwlDg=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "8f7b3b48fc61dc411cac6ebcb0aaaf451ba9c1cb",
+        "rev": "5eb99eb2844b22ebb723711b8e6a0bbb80bb5f04",
         "type": "github"
       },
       "original": {
@@ -157,11 +157,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1789933661,
+        "lastModified": 1789352761,
-        "narHash": "sha256-GtfSaYgUPu91AafiBAQIVEwQiPfIOrgqwmxGtMNDtMI=",
+        "narHash": "sha256-jAcDj4iXkbxa5AlooMRZj7H3E81Cz/q7yN/bX7GPFSU=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "5711f8fed2fcff91a52646e2e856648eca86c331",
+        "rev": "920f6956361496578b8a97ae04ec5f400d729ab4",
         "type": "github"
       },
       "original": {
@@ -211,11 +211,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1789978172,
+        "lastModified": 1789127271,
-        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
+        "narHash": "sha256-vL/Fpo7Zxa7wvO8V5FAToUBvP+K3XsMB1wUglTtd/J0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
+        "rev": "24cfdc1f9344b90a1eee329a3906e2f39f4d0f1e",
         "type": "github"
       },
       "original": {
@@ -226,11 +226,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789344334,
+        "lastModified": 1788921488,
-        "narHash": "sha256-it+7kNGnOOHBCEnl4SfZ7QtfGziH3EryzHqwvJpjAfg=",
+        "narHash": "sha256-JLopN/XSodSsJIZ7v7tEjpPZ+QXc883s3HoUIxHD8Io=",
-        "rev": "c3eea5b2156db11c7eeeada3dc737711255b253e",
+        "rev": "6aefcda9401be8acc2b74244fb3b37520ea1f0a8",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9729.c3eea5b2156d/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9440.6aefcda9401b/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -286,11 +286,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1789921291,
+        "lastModified": 1789286504,
-        "narHash": "sha256-uLLUj+TLUmBc6KrUzx76KZdPi5ZkI1ORR9A6lJUIZlo=",
+        "narHash": "sha256-3i80JnZ9pZ7tWReb/Sqpc32cfzffCu8TWLnbnH0hN9c=",
-        "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4",
+        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077143.44a91898084f/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1073009.ef34387ddd75/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -300,11 +300,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789546076,
+        "lastModified": 1767892417,
-        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -313,11 +313,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789885152,
+        "lastModified": 1789114715,
-        "narHash": "sha256-lIL3uDaS4Q9Ks6klLrBlDr+XS71sbjMJFSipIp2yPjs=",
+        "narHash": "sha256-eeH+/1GxEjw8NCObjaHVIy3YvCQ4Qckrx4LZj5xBaU4=",
-        "rev": "6d663c0533ff269008fb84e45930151e37c99db9",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10304.6d663c0533ff/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9592.21a67dc47014/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -415,11 +415,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789890976,
+        "lastModified": 1788914643,
-        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
         "type": "github"
       },
       "original": {

machines/jupiter/environments.nix

@@ -17,7 +17,7 @@ _: {
     readarr.enable = true;
     sonarr.enable = true;
     jellyfin.enable = true;
-    seerr.enable = true;
+    jellyseerr.enable = true;
     immich.enable = true;
     development.enable = true;
     home-assistant.enable = true;

machines/mibook/network.nix

@@ -4,5 +4,6 @@ _: {
   # firewall otherwise blocks inbound connections from other devices.
   networking.firewall.allowedTCPPorts = [
     9119 # athena hermes dashboard
+    47823 # hermes agent ad-hoc webpage server
   ];
 }

modules/environments/default.nix

@@ -18,7 +18,7 @@
     ./readarr
     ./sonarr
     ./jellyfin
-    ./seerr
+    ./jellyseerr
     ./immich
     ./hermes-agent
   ];

modules/environments/hermes-agent/default.nix

@@ -20,6 +20,9 @@ in
       enable = true;
       # Deliberate pin, matches the approved design — bump on purpose, not by drift.
       settings.model.default = "anthropic/claude-sonnet-4-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
 

modules/environments/home-assistant/default.nix

@@ -54,16 +54,14 @@ in
       "f /var/lib/hass/scenes.yaml 0644 hass hass - []"
     ];
 
-    # Disabled: ZBT-2 antenna isn't connected, so otbr-agent can't reach the
+    services.openthread-border-router = {
-    # radio and just crash-loops on every switch.
+      enable = true;
-    # services.openthread-border-router = {
+      package = pkgs.unstable.openthread-border-router;
-    #   enable = true;
+      openFirewall = true;
-    #   package = pkgs.unstable.openthread-border-router;
+      backboneInterfaces = [ "enp3s0" ];
-    #   openFirewall = true;
+      radio.device = "/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_DCB4D9149C7C-if00";
-    #   backboneInterfaces = [ "enp3s0" ];
+      radio.baudRate = 460800;
-    #   radio.device = "/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_DCB4D9149C7C-if00";
+    };
-    #   radio.baudRate = 460800;
-    # };
 
     my.homepage.services = [
       {

modules/environments/homepage/bookmarks.nix

@@ -1,4 +1,16 @@
 [
+  {
+    Developer = [
+      {
+        Github = [
+          {
+            abbr = "GitLab - Smoothcloud";
+            href = "https://gitlab.smoothcloud.de/";
+          }
+        ];
+      }
+    ];
+  }
   {
     Social = [
       {

modules/environments/homepage/manual-services.nix

@@ -17,10 +17,10 @@
         };
       }
       {
-        "Gitea" = {
+        "GitLab" = {
-          href = "https://git.rechberg.online";
+          href = "https://gitlab.smoothcloud.de";
-          description = "Selfhosted Gitea";
+          description = "Selfhosted GitLab";
-          icon = "gitea.png";
+          icon = "gitlab.png";
         };
       }
       {

modules/environments/immich/default.nix

@@ -18,8 +18,6 @@ in
   config = lib.mkIf cfg.enable {
     services.immich = {
       enable = true;
-      # nixos-26.05 pins immich 2.7.5; pull 3.x from the unstable overlay instead.
-      package = pkgs.unstable.immich;
       host = "0.0.0.0";
       inherit port;
       openFirewall = true;

modules/environments/jellyseerr/default.nix

@@ -1,17 +1,17 @@
 # manages and downloads films
 { config, lib, ... }:
 let
-  cfg = config.my.profiles.seerr;
+  cfg = config.my.profiles.jellyseerr;
   hostName = config.networking.hostName;
   port = 5055;
 in
 {
-  options.my.profiles.seerr = with lib; {
+  options.my.profiles.jellyseerr = with lib; {
-    enable = mkEnableOption "Seerr Media Service";
+    enable = mkEnableOption "JellySeerr Media Service";
   };
 
   config = lib.mkIf cfg.enable {
-    services.seerr = {
+    services.jellyseerr = {
       enable = true;
       openFirewall = true;
     };
@@ -19,14 +19,14 @@ in
     my.homepage.services = [
       {
         group = "Media";
-        name = "Seerr";
+        name = "Jellyseerr";
         description = "Media requests";
         href = "http://${hostName}:${toString port}";
         icon = "mdi-television-guide";
       }
     ];
 
-    systemd.services.seerr = {
+    systemd.services.jellyseerr = {
       after = [ "network-online.target" ];
     };
   };