dotfiles/nixos/hermes-agent.nix at master · colonelpanic8/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{
  config,
  inputs,
  makeEnable,
  pkgs,
  ...
}:
makeEnable config "myModules.hermesAgent" false {
  imports = [inputs.hermes-agent.nixosModules.default];

  age.secrets.hermes-environment = {
    file = ./secrets/hermes-environment.age;
    owner = "imalison";
    group = "users";
    mode = "0400";
  };

  services.hermes-agent = {
    enable = true;
    user = "imalison";
    group = "users";
    createUser = false;
    stateDir = "/home/imalison/.local/share/hermes";
    workingDirectory = "/home/imalison/Projects";
    addToSystemPackages = true;

    settings = {
      model = {
        provider = "openai-codex";
        default = "gpt-5.6-terra";
      };
      toolsets = ["all"];
      approvals.mode = "smart";
      terminal = {
        backend = "local";
        timeout = 1800;
      };
    };

    environment = {
      API_SERVER_ENABLED = "true";
      API_SERVER_HOST = "100.90.1.42";
      API_SERVER_PORT = "8642";
    };
    environmentFiles = [config.age.secrets.hermes-environment.path];

    extraPackages = with pkgs; [
      curl
      findutils
      gh
      gnugrep
      gnused
      jq
      nix
      openssh
      ripgrep
      zsh
    ];
  };

  systemd.services.hermes-agent = {
    after = ["agenix.service" "tailscaled.service"];
    wants = ["tailscaled.service"];
  };

  networking.firewall.interfaces."tailscale0".allowedTCPPorts = [8642];
}