Feat/sops nix #12

2026-09-08T21:22:18+02:00

finn.markwitz commented

2026-09-08 21:22:18 +02:00

No description provided.

finn.markwitz added 4 commits 2026-09-08 21:22:18 +02:00

chore: Flake Update 70deb25080

feat(sops): add sops-nix input, core module and devShell tooling 3ab8bfbb91

Wires sops-nix into every machine via machines/core/sops.nix so hosts
decrypt with their existing SSH host key. Adds a devShell exposing
sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's
previously no-op `use flake`.

feat(mibook): decrypt placeholder secret via host age key a00916864c

Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.

Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.

docs: sops-nix secrets workflow 621ca5dde6

Operator runbook for adding a secret, adding a new host, and rotating
keys, plus a pointer from CLAUDE.md's architecture overview.

finn.markwitz added 10 commits 2026-09-10 10:56:57 +02:00

docs: design spec for Hermes Agent on mibook 6212b4fcf7

Locks in host (mibook, not jupiter), deployment mode (NixOS native
module), and auth (claude setup-token / ANTHROPIC_TOKEN, Max extra
credits) after a grilling round. Builds on feat/sops-nix as-is.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

docs: implementation plan for Hermes Agent on mibook a83f7e63a0

Task 1 is agent-executable repo wiring (flake input, profile module,
secret declaration), build-checked with nix build. Tasks 2-5 are an
operator-run runbook: OAuth login, Anthropic billing check, Telegram
bot setup, and typing real secrets into $EDITOR via sops - none of
that is meant to pass through an agent session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

chore: ignore .superpowers/ scratch workspace 32e0faa82c

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

feat(mibook): add Hermes Agent profile module 731678ecac

docs: correct plan's sops build-check assumption ac32aca351

Task 1's implementer found sops.validateSopsFiles makes secret-key
existence a build-time check (via manifest.json.drv), not an
activation-time one as the plan assumed. Corrects Step 10 to reflect
reality rather than leave future readers misled.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

docs: correct spec+plan per final whole-plan review findings 0249aae2ae

Final review (opus) found a Critical bug (jupiter's nixosConfigurations
stopped evaluating because hermes-agent.nixosModules.default was wired
through machines/configuration.nix's mibook-only module list, while
the profile module itself is loaded on both machines) plus three
Important gaps: secrets persist to /var/lib/hermes/.hermes/.env, not
/run/secrets; Telegram/Email need explicit ALLOWED_USERS or they're
wide open / silently drop messages; addToSystemPackages's CLI needs
group membership finn didn't have. All four corrected in the docs
here; the actual code fix is a separate dispatched task.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

fix(mibook): import hermes-agent module from the profile, not machines/configuration.nix 31e1910d75

machines/configuration.nix wired hermes-agent.nixosModules.default into
mibook's mibook-only modules list. modules/environments/default.nix is
machine-agnostic, so jupiter still evaluated a
services.hermes-agent = lib.mkIf false { ... } definition for an option it
never declared as existing — NixOS errors on that regardless of mkIf's
condition, breaking nixosConfigurations.jupiter (and the repo's sole CI
job) entirely.

Fix: import the upstream module unconditionally from inside
modules/environments/hermes-agent/default.nix itself, so the option is
declared everywhere modules/environments/default.nix loads, and only ever
turned on where my.profiles.hermes-agent.enable = true (mibook). Also adds
users.users.finn.extraGroups = [ "hermes" ], required for the hermes CLI to
be usable per the corrected design. machines/configuration.nix no longer
mentions hermes-agent.

Deviates from the reconciled spec/plan text in one respect: uses `self`
(from specialArgs) instead of `inputs` (from _module.args) to reach the
flake input inside `imports`. Using `inputs` there reproduced infinite
recursion — NixOS resolves a module's imports before _module.args
assignments are merged, so an import list cannot depend on an arg that
itself comes from config. `self` is available at import-time via
specialArgs, `inputs` is not, in this repo's wiring. See report for detail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

docs: correct spec+plan for self-vs-inputs in imports 0756eb94cd

The fix subagent found that inputs.hermes-agent.nixosModules.default
inside `imports` causes infinite recursion in this repo's wiring
(inputs comes from _module.args, which merges after imports resolve;
self comes from specialArgs, which is available at import-time).
Tested both ways. Update docs to show self.inputs, matching commit
31e1910.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

feat(mibook): populate Hermes Agent credentials c4b29e1e06

feat(hermes-agent): expose dashboard on LAN with basic auth 67973559c0

Bind the backend to 0.0.0.0:9119 in dashboard mode so the web UI is
reachable from the local network, open the port in the firewall, and
add dashboard username/password credentials to the mibook hermes-env
secret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sux8hmeb2qadqPqbJ1zNzL

finn.markwitz added 1 commit 2026-09-10 11:09:50 +02:00

feat(homepage): add Athena Dashboard link to jupiter's homepage 807eea7e4f

Hermes Agent's dashboard runs on mibook, but the homepage-dashboard
service only runs on jupiter, so wire it in as a manual cross-host
entry rather than via my.homepage.services (which is scoped per-host
and would be inert on mibook).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sux8hmeb2qadqPqbJ1zNzL

finn.markwitz added 1 commit 2026-09-14 13:06:36 +02:00

Merge branch 'main' into feat/sops-nix 9dbd6ff71d

finn.markwitz merged commit 4691eb1aa4 into main

2026-09-14 13:06:46 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: finn.markwitz/nixos#12