# Hermes Agent — Telegram + Email messaging gateway (Claude subscription auth)
{
  config,
  lib,
  pkgs,
  self,
  ...
}:
let
  cfg = config.my.profiles.hermes-agent;
in
{
  imports = [ self.inputs.hermes-agent.nixosModules.default ];

  options.my.profiles.hermes-agent.enable =
    lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";

  config = lib.mkIf cfg.enable {
    services.hermes-agent = {
      enable = true;
      # Deliberate pin, matches the approved design — bump on purpose, not by drift.
      settings.model.default = "anthropic/claude-sonnet-4-5";
      environmentFiles = [ config.sops.secrets."hermes-env".path ];
      addToSystemPackages = true;

      backend = {
        # "dashboard" serves the browser admin panel, not just the API.
        mode = "dashboard";
        # Non-loopback bind opens the dashboard's auth gate — username/password
        # comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
        host = "0.0.0.0";
        port = 9119;
      };
    };

    # NixOS default-deny firewall otherwise blocks inbound LAN connections.
    networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];

    # addToSystemPackages only puts `hermes` on $PATH; using it needs group
    # access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
    # this machine's one human user and already knows hermes-env's contents
    # (typed them into sops directly), so this is not new exposure.
    users.users.finn.extraGroups = [ "hermes" ];
  };
}