Merge remote-tracking branch 'origin/dev'

- mkHost now takes a role list, roles resolve to ./roles/<name>.nix
- roles/core.nix = shared baseline (modules/)
- roles/k3s-server.nix = core + k3s (goyplex-vm)
- roles/hermes.nix = core + hermes (hermes-vm)
- host configuration.nix trimmed to hardware + boot + stateVersion
- optional hosts/<name>/custom.nix loads last for per-host overrides
- new hosts: one flake line + hosts/<name>/ dir

flake.lock

@@ -41,11 +41,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784368054,
+        "lastModified": 1787400831,
-        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
+        "narHash": "sha256-H3MEkFDZf+UH+QrVgW8TdKrssPFltF8fBg/rh0J1zIc=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
+        "rev": "7ce889cb78b97979b83a4648509fc3ef405c3286",
         "type": "github"
       },
       "original": {
@@ -100,11 +100,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1782949081,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -116,6 +116,7 @@
     "hermes-agent": {
       "inputs": {
         "flake-parts": "flake-parts",
+        "home-manager": "home-manager_2",
         "nixpkgs": "nixpkgs_2",
         "npm-lockfile-fix": "npm-lockfile-fix",
         "pyproject-build-systems": "pyproject-build-systems",
@@ -123,11 +124,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1784644108,
+        "lastModified": 1787852122,
-        "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=",
+        "narHash": "sha256-QFOvSx7laGYIIPq+LNNEyrqxfSmXOrv+4Y80nKbXkjA=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d",
+        "rev": "0dfba37b11ff2ca908ae2df85b55f4f4c9b7fd8b",
         "type": "github"
       },
       "original": {
@@ -143,11 +144,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784601896,
+        "lastModified": 1787500880,
-        "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=",
+        "narHash": "sha256-UrAlku7KST0DT+j1bdVGYI8tCz23PWL88uGMer3IZ2U=",
         "owner": "feel-co",
         "repo": "hjem",
-        "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679",
+        "rev": "d248f0e4f7abd6e1f0eb9ace778dd7928481943e",
         "type": "github"
       },
       "original": {
@@ -161,17 +162,16 @@
         "hjem": [
           "hjem"
         ],
-        "nix-darwin": "nix-darwin",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1784361899,
+        "lastModified": 1787315974,
-        "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=",
+        "narHash": "sha256-LLToYudTlFqNY0NsG//CnE2I/zF0cpktX44ZhFJ2alY=",
         "owner": "snugnug",
         "repo": "hjem-rum",
-        "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60",
+        "rev": "217c6e1f445b3973ca8f988f070c9b84cceaa1ca",
         "type": "github"
       },
       "original": {
@@ -201,6 +201,27 @@
         "type": "github"
       }
     },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786487128,
+        "narHash": "sha256-ad60hrRVhH/bo3Jl1YLzO+QcS3mUNZr9LNJdzhMO2P4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "f404edbfa4117810c96b97048299242fc50e5362",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "hyprcursor": {
       "inputs": {
         "hyprlang": [
@@ -217,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776511930,
+        "lastModified": 1786464181,
-        "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=",
+        "narHash": "sha256-2alOMkLjXANh7unkZnYnCF2K2rApZaOLMoQ3o+VX2CY=",
         "owner": "hyprwm",
         "repo": "hyprcursor",
-        "rev": "39435900785d0c560c6ae8777d29f28617d031ef",
+        "rev": "e4ed7c08123df5af460a0a70961380cbfb872f76",
         "type": "github"
       },
       "original": {
@@ -246,11 +267,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782566056,
+        "lastModified": 1786464367,
-        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
+        "narHash": "sha256-k58p4wbzIXWyRWrW84pP8tD+iaZSSYiiM+fr0Auk4oU=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
+        "rev": "7c895c44e3ca6d28ed68ddd80ec02b02b925e7fc",
         "type": "github"
       },
       "original": {
@@ -276,11 +297,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1784641930,
+        "lastModified": 1787842129,
-        "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=",
+        "narHash": "sha256-+C4MYYZsT+JdgZj70g7ERYm4zjJRwRnwy7o1QHPW5eg=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda",
+        "rev": "3b1aa6be7b8d672c7180ea616f9eca1992e227c3",
         "type": "github"
       },
       "original": {
@@ -322,11 +343,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784196523,
+        "lastModified": 1786464504,
-        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
+        "narHash": "sha256-7sHwM86KILQyHDHDuE2SDBlQ2jvZ0EW3hY7sW009/cg=",
         "owner": "hyprwm",
         "repo": "hyprland-guiutils",
-        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
+        "rev": "4c30cf3097ea963c0e250749ee0c59f8b08816d6",
         "type": "github"
       },
       "original": {
@@ -376,11 +397,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777320127,
+        "lastModified": 1786464129,
-        "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=",
+        "narHash": "sha256-339AkTlpMYSIvFuG0rnR+8Yg4/AZKeJalshJavlnKfg=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc",
+        "rev": "9508458be316a0d70d37ebed1ab725ccd10411ff",
         "type": "github"
       },
       "original": {
@@ -428,11 +449,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782554491,
+        "lastModified": 1785930473,
-        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
+        "narHash": "sha256-DitTu625BhEYpZjtjxtGpjrEJwPwW+X/+jJvhSZNSJM=",
         "owner": "hyprwm",
         "repo": "hyprtoolkit",
-        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
+        "rev": "af515b69dfbe366dc7873aa1475cb2f4db3ebad7",
         "type": "github"
       },
       "original": {
@@ -453,11 +474,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784323413,
+        "lastModified": 1786903207,
-        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
+        "narHash": "sha256-QTwMqLLONRhv9iz6CVeuX6BqQNQCIqI8hL/cPYlR/24=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
+        "rev": "6cf50415e06dc6bd9f1252f1b745eac6b4a1cc39",
         "type": "github"
       },
       "original": {
@@ -478,11 +499,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777159683,
+        "lastModified": 1786464033,
-        "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=",
+        "narHash": "sha256-QM8Qe4/L8lpdVN4bgwahmi+jyyc4fisseDMe4afcDxA=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404",
+        "rev": "62e62c1ca23da17612c6890d4ad2064f575643db",
         "type": "github"
       },
       "original": {
@@ -507,11 +528,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778410714,
+        "lastModified": 1786464294,
-        "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=",
+        "narHash": "sha256-ZQsZ2WvBdkboCIyh8LStDPdAIARmxzn0XMNxxoOhjPE=",
         "owner": "hyprwm",
         "repo": "hyprwire",
-        "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc",
+        "rev": "4ce7cd6b6128c1ac41caf23c58a30a26b327f9dd",
         "type": "github"
       },
       "original": {
@@ -520,27 +541,6 @@
         "type": "github"
       }
     },
-    "nix-darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "hjem-rum",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1779036909,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
-        "owner": "nix-darwin",
-        "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-darwin",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1754028485,
@@ -559,11 +559,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1775036866,
+        "lastModified": 1785318670,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
@@ -575,11 +575,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1784356753,
+        "lastModified": 1787360063,
-        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
+        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
         "type": "github"
       },
       "original": {
@@ -591,11 +591,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1784497964,
+        "lastModified": 1787736819,
-        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
+        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
+        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
         "type": "github"
       },
       "original": {
@@ -664,11 +664,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772555609,
+        "lastModified": 1785115949,
-        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
         "owner": "pyproject-nix",
         "repo": "build-system-pkgs",
-        "rev": "c37f66a953535c394244888598947679af231863",
+        "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
         "type": "github"
       },
       "original": {
@@ -685,11 +685,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772865871,
+        "lastModified": 1784591072,
-        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
         "owner": "pyproject-nix",
         "repo": "pyproject.nix",
-        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
         "type": "github"
       },
       "original": {
@@ -750,11 +750,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773039484,
+        "lastModified": 1785277507,
-        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
+        "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
+        "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977",
         "type": "github"
       },
       "original": {
@@ -791,11 +791,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784371182,
+        "lastModified": 1786988229,
-        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
+        "narHash": "sha256-frEFLVRj8xXvBBDs44IRiqHo6R2PxsRpluygL7abjjI=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
+        "rev": "59d429bf45aed4e2209043c0c36565ad8e2859a5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -27,26 +27,40 @@
     let
       system = "x86_64-linux";
       username = "poslop";
+      lib = nixpkgs.lib;
+
+      # mkHost <hostname> <role list>
+      # roles resolve to ./roles/<name>.nix; list entries may also be
+      # inline attrsets or paths, which load after (and override) roles.
+      # hosts/<host>/custom.nix, if present, always loads last.
       mkHost =
-        host: modules:
+        name: roles:
         nixpkgs.lib.nixosSystem {
-          modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules;
+          modules =
+            [ { nixpkgs.hostPlatform = system; } ]
+            ++ [ ./hosts/${name}/configuration.nix ]
+            ++ map (
+              role:
+              if builtins.isString role then ./roles/${role}.nix else role
+            ) roles
+            ++ lib.optional (builtins.pathExists ./hosts/${name}/custom.nix)
+              ./hosts/${name}/custom.nix;
           specialArgs = {
             inherit
               self
               inputs
               username
-              host
               ;
+            host = name;
           };
         };
     in
     {
       nixosConfigurations = {
-        nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ];
+        nixos-vm2 = mkHost "nixos-vm2" [ "core" ];
-        qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ];
+        qemu-vm = mkHost "qemu-vm" [ "core" ];
-        goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ];
+        goyplex-vm = mkHost "goyplex-vm" [ "k3s-server" ];
-        hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ];
+        hermes-vm = mkHost "hermes-vm" [ "hermes" ];
       };
     };
 }

hosts/goyplex-vm/configuration.nix

@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
-    ../../modules/k3s/k3s.nix
   ];
 
   boot.loader.systemd-boot.enable = true;

hosts/hermes-vm/configuration.nix

@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
-    ../../modules/hermes
   ];
 
   boot.loader.systemd-boot.enable = true;

hosts/nixos-vm2/configuration.nix

@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;

hosts/qemu-vm/configuration.nix

@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;

modules/core/network.nix

@@ -3,4 +3,6 @@
 {
   networking.hostName = host;
   networking.networkmanager.enable = true;
+
+  services.netbird.enable = true;
 }

modules/hermes/hermes.nix

@@ -1,6 +1,7 @@
 {
   inputs,
   config,
+  pkgs,
   ...
 }:
 
@@ -14,6 +15,10 @@
       config.age.secrets.hermes-env.path
     ];
 
+    environment = {
+      BW_SERVERURL = "https://vault.archfox.org";
+    };
+
     container = {
       image = "debian:bookworm";
       backend = "docker";
@@ -24,6 +29,8 @@
         "9119:9119"
         "-p"
         "8642:8642"
+        "-p"
+        "9120:9120"
       ];
     };
 
@@ -34,7 +41,17 @@
         mcp_reload_confirm = "false";
       };
 
+      gateway = {
+        multiplex_profiles = true;
+      };
+
+      delegation = {
+        model = "z-ai/glm-5.3-flash";
+        provider = "nous";
+      };
+
       memory = {
+        provider = "holographic";
         memory_enabled = true;
         user_profile_enabled = true;
       };
@@ -43,11 +60,6 @@
         credits_notices = true;
       };
 
-      delegation = {
-        model = "us.anthropic.claude-sonnet-5";
-        provider = "bedrock";
-      };
-
       discord = {
         group_sessions_per_user = false;
         reactions = false;
@@ -55,9 +67,68 @@
     };
   };
 
+  systemd.services.hermes-serve = {
+    description = "Hermes Agent Serve (desktop remote backend)";
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "hermes-agent.service"
+      "network-online.target"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "hermes-agent.service" ];
+
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = 5;
+      TimeoutStopSec = 15;
+    };
+
+    script = ''
+      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
+        -e HERMES_HOME=/data/.hermes \
+        -e HOME=/home/hermes \
+        hermes-agent \
+        /data/current-package/bin/hermes serve \
+          --host 0.0.0.0 \
+          --port 9120
+    '';
+  };
+
+  systemd.services.hermes-dashboard = {
+    description = "Hermes Agent Dashboard (web UI)";
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "hermes-agent.service"
+      "network-online.target"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "hermes-agent.service" ];
+
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = 5;
+      TimeoutStopSec = 15;
+    };
+
+    script = ''
+      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
+        -e HERMES_HOME=/data/.hermes \
+        -e HOME=/home/hermes \
+        hermes-agent \
+        /data/current-package/bin/hermes dashboard \
+          --host 0.0.0.0 \
+          --port 9121 \
+          --no-open
+    '';
+  };
+
   networking.firewall.allowedTCPPorts = [
     8080
     9119
+    9120
+    9121
     8642
   ];
 }

modules/hermes/secrets/agenix.nix

@@ -10,6 +10,6 @@
   age.secrets."hermes-env".file = ./hermes-env.age;
 
   hjem.users.${username}.packages = with pkgs; [
-    inputs.agenix.packages."${system}".default
+    inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
   ];
 }

roles/core.nix

@@ -0,0 +1,6 @@
+{
+  # shared baseline: core system + home manager config
+  imports = [
+    ../modules
+  ];
+}

roles/hermes.nix

@@ -0,0 +1,7 @@
+{
+  # hermes agent host: core + hermes container + secrets
+  imports = [
+    ./core.nix
+    ../modules/hermes
+  ];
+}

roles/k3s-server.nix

@@ -0,0 +1,7 @@
+{
+  # k3s server node (goyplex-vm): k3s + manifests + firewall
+  imports = [
+    ./core.nix
+    ../modules/k3s/k3s.nix
+  ];
+}