finn.markwitzandClaude Sonnet 5
67973559c0
Bind the backend to 0.0.0.0:9119 in dashboard mode so the web UI is reachable from the local network, open the port in the firewall, and add dashboard username/password credentials to the mibook hermes-env secret. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sux8hmeb2qadqPqbJ1zNzL
46 lines
1.5 KiB
Nix
46 lines
1.5 KiB
Nix
# Hermes Agent — Telegram + Email messaging gateway (Claude subscription auth)
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
self,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.my.profiles.hermes-agent;
|
|
in
|
|
{
|
|
imports = [ self.inputs.hermes-agent.nixosModules.default ];
|
|
|
|
options.my.profiles.hermes-agent.enable =
|
|
lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.hermes-agent = {
|
|
enable = true;
|
|
# Deliberate pin, matches the approved design — bump on purpose, not by drift.
|
|
settings.model.default = "anthropic/claude-sonnet-4-5";
|
|
environmentFiles = [ config.sops.secrets."hermes-env".path ];
|
|
addToSystemPackages = true;
|
|
|
|
backend = {
|
|
# "dashboard" serves the browser admin panel, not just the API.
|
|
mode = "dashboard";
|
|
# Non-loopback bind opens the dashboard's auth gate — username/password
|
|
# comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
|
|
host = "0.0.0.0";
|
|
port = 9119;
|
|
};
|
|
};
|
|
|
|
# NixOS default-deny firewall otherwise blocks inbound LAN connections.
|
|
networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];
|
|
|
|
# addToSystemPackages only puts `hermes` on $PATH; using it needs group
|
|
# access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
|
|
# this machine's one human user and already knows hermes-env's contents
|
|
# (typed them into sops directly), so this is not new exposure.
|
|
users.users.finn.extraGroups = [ "hermes" ];
|
|
};
|
|
}
|