finn.markwitzandClaude Sonnet 5
84ada68069
Its self-updater was independently polling GitHub for the same repo the flake input tracks, and stacked with a runaway crash-restart loop this exhausted the GitHub rate limit, causing unrelated flake fetches to 429. The Nix flake input is already the source of truth for hermes's version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3
49 lines
1.7 KiB
Nix
49 lines
1.7 KiB
Nix
# Hermes Agent — Telegram + Email messaging gateway (Claude subscription auth)
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
self,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.my.profiles.hermes-agent;
|
|
in
|
|
{
|
|
imports = [ self.inputs.hermes-agent.nixosModules.default ];
|
|
|
|
options.my.profiles.hermes-agent.enable =
|
|
lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.hermes-agent = {
|
|
enable = true;
|
|
# Deliberate pin, matches the approved design — bump on purpose, not by drift.
|
|
settings.model.default = "anthropic/claude-sonnet-4-5";
|
|
# The Nix flake input is the source of truth for hermes's version here; its
|
|
# built-in self-updater polling GitHub independently just burns API quota.
|
|
settings.updates.check = false;
|
|
environmentFiles = [ config.sops.secrets."hermes-env".path ];
|
|
addToSystemPackages = true;
|
|
|
|
backend = {
|
|
# "dashboard" serves the browser admin panel, not just the API.
|
|
mode = "dashboard";
|
|
# Non-loopback bind opens the dashboard's auth gate — username/password
|
|
# comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
|
|
host = "0.0.0.0";
|
|
port = 9119;
|
|
};
|
|
};
|
|
|
|
# NixOS default-deny firewall otherwise blocks inbound LAN connections.
|
|
networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];
|
|
|
|
# addToSystemPackages only puts `hermes` on $PATH; using it needs group
|
|
# access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
|
|
# this machine's one human user and already knows hermes-env's contents
|
|
# (typed them into sops directly), so this is not new exposure.
|
|
users.users.finn.extraGroups = [ "hermes" ];
|
|
};
|
|
}
|