hermes: add serve and dashboard services, run as hermes user

- Add hermes-serve (port 9120) for desktop JSON-RPC backend
- Add hermes-dashboard (port 9121) for web UI
- Both docker exec with -u hermes to avoid root-owned files
- Add BW_SERVERURL env var
- Expose port 9120 in container extraOptions

modules/hermes/hermes.nix

@@ -1,6 +1,8 @@
 {
   inputs,
   config,
+  lib,
+  pkgs,
   ...
 }:
 
@@ -14,6 +16,10 @@
       config.age.secrets.hermes-env.path
     ];
 
+    environment = {
+      BW_SERVERURL = "https://vault.archfox.org";
+    };
+
     container = {
       image = "debian:bookworm";
       backend = "docker";
@@ -24,6 +30,8 @@
         "9119:9119"
         "-p"
         "8642:8642"
+        "-p"
+        "9120:9120"
       ];
     };
 
@@ -55,9 +63,66 @@
     };
   };
 
+  # Hermes serve (desktop app JSON-RPC backend, headless)
+  # Port 9120 avoids conflict with the gateway's API server on 9119.
+  systemd.services.hermes-serve = {
+    description = "Hermes Agent Serve (desktop remote backend)";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "hermes-agent.service" "network-online.target" ];
+    wants = [ "network-online.target" ];
+    requires = [ "hermes-agent.service" ];
+
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = 5;
+      TimeoutStopSec = 15;
+    };
+
+    script = ''
+      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
+        -e HERMES_HOME=/data/.hermes \
+        -e HOME=/home/hermes \
+        hermes-agent \
+        /data/current-package/bin/hermes serve \
+          --host 0.0.0.0 \
+          --port 9120
+    '';
+  };
+
+  # Hermes dashboard (web UI for browser access)
+  # Port 9121, full web dashboard with login page.
+  systemd.services.hermes-dashboard = {
+    description = "Hermes Agent Dashboard (web UI)";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "hermes-agent.service" "network-online.target" ];
+    wants = [ "network-online.target" ];
+    requires = [ "hermes-agent.service" ];
+
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = 5;
+      TimeoutStopSec = 15;
+    };
+
+    script = ''
+      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
+        -e HERMES_HOME=/data/.hermes \
+        -e HOME=/home/hermes \
+        hermes-agent \
+        /data/current-package/bin/hermes dashboard \
+          --host 0.0.0.0 \
+          --port 9121 \
+          --no-open
+    '';
+  };
+
   networking.firewall.allowedTCPPorts = [
     8080
     9119
+    9120
+    9121
     8642
   ];
 }