goyplex-vm: disable k3s network-policy controller (kube-router fwmark 0x20000 collides with netbird routing-peer mark 0x1bd20; no NetworkPolicies in use)

core: add netbird package
goyplex-vm: add fen user (key + NOPASSWD sudo), fix rebuild.sh host, retire hermes input
2026-09-09 20:29:43 -05:00 · 2026-09-05 09:32:39 -05:00 · 2026-09-05 09:16:55 -05:00 · 2026-09-04 15:05:49 -05:00 · 2026-09-04 15:05:23 -05:00 · 2026-09-04 15:03:26 -05:00
17 changed files with 64 additions and 403 deletions
@@ -41,11 +41,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787400831,
-        "narHash": "sha256-H3MEkFDZf+UH+QrVgW8TdKrssPFltF8fBg/rh0J1zIc=",
+        "lastModified": 1788444081,
+        "narHash": "sha256-I8i97p9WBQaZQyyBaHFMt8e01VfgfFZSaO+vAUd0u0A=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "7ce889cb78b97979b83a4648509fc3ef405c3286",
+        "rev": "36b66db4ddd708ad19f5db850af6a478d8a19b2a",
        "type": "github"
      },
      "original": {
@@ -92,51 +92,6 @@
        "type": "github"
      }
    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "hermes-agent",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1782949081,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "hermes-agent": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2",
-        "npm-lockfile-fix": "npm-lockfile-fix",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1787852122,
-        "narHash": "sha256-QFOvSx7laGYIIPq+LNNEyrqxfSmXOrv+4Y80nKbXkjA=",
-        "owner": "NousResearch",
-        "repo": "hermes-agent",
-        "rev": "0dfba37b11ff2ca908ae2df85b55f4f4c9b7fd8b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NousResearch",
-        "repo": "hermes-agent",
-        "type": "github"
-      }
-    },
    "hjem": {
      "inputs": {
        "nixpkgs": [
@@ -201,27 +156,6 @@
        "type": "github"
      }
    },
-    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1786487128,
-        "narHash": "sha256-ad60hrRVhH/bo3Jl1YLzO+QcS3mUNZr9LNJdzhMO2P4=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "f404edbfa4117810c96b97048299242fc50e5362",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
    "hyprcursor": {
      "inputs": {
        "hyprlang": [
@@ -291,17 +225,17 @@
        "hyprutils": "hyprutils",
        "hyprwayland-scanner": "hyprwayland-scanner",
        "hyprwire": "hyprwire",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
        "pre-commit-hooks": "pre-commit-hooks",
        "systems": "systems_2",
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1787842129,
-        "narHash": "sha256-+C4MYYZsT+JdgZj70g7ERYm4zjJRwRnwy7o1QHPW5eg=",
+        "lastModified": 1788607141,
+        "narHash": "sha256-yjVNYxNkV7KST+K1kW0i4uts2KvZDuK98oot12xHJQ0=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "3b1aa6be7b8d672c7180ea616f9eca1992e227c3",
+        "rev": "2eb5180c6f258bb73c4b9b71a1361dede0e1453e",
        "type": "github"
      },
      "original": {
@@ -559,11 +493,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1785318670,
-        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
+        "lastModified": 1788404924,
+        "narHash": "sha256-lhEhY8X5EgkQ/eg6IFz4cc8jRuSYSvnxx1al7d1dvZ0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
+        "rev": "0968519e14f7aa7d3e9b389682bd74d2b51c8ce8",
        "type": "github"
      },
      "original": {
@@ -575,27 +509,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1787360063,
-        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1787736819,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "lastModified": 1788531059,
+        "narHash": "sha256-hLD4l3QOGBQhkVp3mQ2lJ/YbEi99qUgKapb40KovZ88=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "801bef6abd86b91e51083066b83fb354a11fc640",
        "type": "github"
      },
      "original": {
@@ -605,27 +523,6 @@
        "type": "github"
      }
    },
-    "npm-lockfile-fix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775903712,
-        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
-        "owner": "jeslie0",
-        "repo": "npm-lockfile-fix",
-        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jeslie0",
-        "repo": "npm-lockfile-fix",
-        "type": "github"
-      }
-    },
    "pre-commit-hooks": {
      "inputs": {
        "flake-compat": "flake-compat",
@@ -635,11 +532,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784288435,
-        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
        "type": "github"
      },
      "original": {
@@ -648,64 +545,13 @@
        "type": "github"
      }
    },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "hermes-agent",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "hermes-agent",
-          "uv2nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1785115949,
-        "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1784591072,
-        "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "agenix": "agenix",
-        "hermes-agent": "hermes-agent",
        "hjem": "hjem",
        "hjem-rum": "hjem-rum",
        "hyprland": "hyprland",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_3"
      }
    },
    "systems": {
@@ -738,31 +584,6 @@
        "type": "github"
      }
    },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "hermes-agent",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1785277507,
-        "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    },
    "xdph": {
      "inputs": {
        "hyprland-protocols": [
@@ -791,11 +612,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786988229,
-        "narHash": "sha256-frEFLVRj8xXvBBDs44IRiqHo6R2PxsRpluygL7abjjI=",
+        "lastModified": 1788025068,
+        "narHash": "sha256-TBqronrrc/F2Ry/E37d/1TLldDLJDFNSwvJjgk+cXzU=",
        "owner": "hyprwm",
        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "59d429bf45aed4e2209043c0c36565ad8e2859a5",
+        "rev": "ba31964ee42b56bcb0d3b78a64ead5d8a1c3c6f6",
        "type": "github"
      },
      "original": {
@@ -3,7 +3,6 @@
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    hyprland.url = "github:hyprwm/Hyprland";
-    hermes-agent.url = "github:NousResearch/hermes-agent";
    agenix.url = "github:ryantm/agenix";

    hjem = {
@@ -60,7 +59,6 @@
        nixos-vm2 = mkHost "nixos-vm2" [ "core" ];
        qemu-vm = mkHost "qemu-vm" [ "core" ];
        goyplex-vm = mkHost "goyplex-vm" [ "k3s-server" ];
-        hermes-vm = mkHost "hermes-vm" [ "hermes" ];
      };
    };
 }
@@ -9,7 +9,7 @@
    ./timezone.nix
    ./nix.nix
    ./program.nix
-    ./user.nix
+    ./users.nix
    ./ssh.nix
  ];
 }
@@ -1,5 +1,5 @@
 {
-  nix.settings = {
-    experimental-features = "nix-command flakes";
-  };
+  # nix.settings = {
+  #   experimental-features = "nix-command flakes";
+  # };
 }
@@ -2,6 +2,7 @@
 {
  environment.systemPackages = with pkgs; [
    zsh
+    netbird
  ];

 }
@@ -1,14 +0,0 @@
-{ username, pkgs, ... }:
-
-{
-  users.users.${username} = {
-    isNormalUser = true;
-    description = "${username}";
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    shell = pkgs.zsh;
-  };
-  nix.settings.allowed-users = [ "@wheel" ];
-}
@@ -0,0 +1,35 @@
+{ username, pkgs, ... }:
+
+{
+  users.users.${username} = {
+    isNormalUser = true;
+    description = "${username}";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    shell = pkgs.zsh;
+  };
+
+  users.users.fen = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8nZT7pA+Wp7mnjKSJPpmYs+tFx5q+gtvOcSSMJt93D fen"
+    ];
+  };
+
+  nix.settings.allowed-users = [ "@wheel" ];
+
+  security.sudo.extraRules = [
+    {
+      users = [ "fen" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+}
@@ -1,7 +0,0 @@
-{
-  imports = [
-    ./sudo.nix
-    ./hermes.nix
-    ./secrets
-  ];
-}
@@ -1,134 +0,0 @@
-{
-  inputs,
-  config,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ inputs.hermes-agent.nixosModules.default ];
-
-  services.hermes-agent = {
-    enable = true;
-    addToSystemPackages = true;
-    environmentFiles = [
-      config.age.secrets.hermes-env.path
-    ];
-
-    environment = {
-      BW_SERVERURL = "https://vault.archfox.org";
-    };
-
-    container = {
-      image = "debian:bookworm";
-      backend = "docker";
-      enable = true;
-      hostUsers = [ "poslop" ];
-      extraOptions = [
-        "-p"
-        "9119:9119"
-        "-p"
-        "8642:8642"
-        "-p"
-        "9120:9120"
-      ];
-    };
-
-    settings = {
-      approvals = {
-        mode = "off";
-        cron_mode = "deny";
-        mcp_reload_confirm = "false";
-      };
-
-      gateway = {
-        multiplex_profiles = true;
-      };
-
-      delegation = {
-        model = "z-ai/glm-5.3-flash";
-        provider = "nous";
-      };
-
-      memory = {
-        provider = "holographic";
-        memory_enabled = true;
-        user_profile_enabled = true;
-      };
-
-      display = {
-        credits_notices = true;
-      };
-
-      discord = {
-        group_sessions_per_user = false;
-        reactions = false;
-      };
-    };
-  };
-
-  systemd.services.hermes-serve = {
-    description = "Hermes Agent Serve (desktop remote backend)";
-    wantedBy = [ "multi-user.target" ];
-    after = [
-      "hermes-agent.service"
-      "network-online.target"
-    ];
-    wants = [ "network-online.target" ];
-    requires = [ "hermes-agent.service" ];
-
-    serviceConfig = {
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 5;
-      TimeoutStopSec = 15;
-    };
-
-    script = ''
-      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
-        -e HERMES_HOME=/data/.hermes \
-        -e HOME=/home/hermes \
-        hermes-agent \
-        /data/current-package/bin/hermes serve \
-          --host 0.0.0.0 \
-          --port 9120
-    '';
-  };
-
-  systemd.services.hermes-dashboard = {
-    description = "Hermes Agent Dashboard (web UI)";
-    wantedBy = [ "multi-user.target" ];
-    after = [
-      "hermes-agent.service"
-      "network-online.target"
-    ];
-    wants = [ "network-online.target" ];
-    requires = [ "hermes-agent.service" ];
-
-    serviceConfig = {
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 5;
-      TimeoutStopSec = 15;
-    };
-
-    script = ''
-      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
-        -e HERMES_HOME=/data/.hermes \
-        -e HOME=/home/hermes \
-        hermes-agent \
-        /data/current-package/bin/hermes dashboard \
-          --host 0.0.0.0 \
-          --port 9121 \
-          --no-open
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    8080
-    9119
-    9120
-    9121
-    8642
-  ];
-}
@@ -1,15 +0,0 @@
-{
-  inputs,
-  pkgs,
-  username,
-  ...
-}:
-
-{
-  imports = [ inputs.agenix.nixosModules.default ];
-  age.secrets."hermes-env".file = ./hermes-env.age;
-
-  hjem.users.${username}.packages = with pkgs; [
-    inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
-  ];
-}
@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./agenix.nix
-  ];
-}
@@ -1,6 +0,0 @@
-let
-  hermes-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFqtbtEYL4pPNvJV64FjDXT6zT2ew0IFK8XHJ9LP7ae";
-in
-{
-  "hermes-env.age".publicKeys = [ hermes-vm ];
-}
@@ -1,13 +0,0 @@
-{
-  security.sudo.extraRules = [
-    {
-      users = [ "poslop" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/docker";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
-}
@@ -11,7 +11,7 @@
  services.k3s = {
    enable = true;
    role = "server";
-    extraFlags = "--write-kubeconfig-mode 644";
+    extraFlags = "--write-kubeconfig-mode 644 --disable-network-policy";
  };

  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
@@ -1 +1 @@
-sudo nixos-rebuild switch --flake ./#qemu-vm
+sudo nixos-rebuild switch --flake ./#goyplex-vm
@@ -1,7 +1,7 @@
 {
-  # hermes agent host: core + hermes container + secrets
+  # hermes agent retired (migrated to standalone debian VM fen-vm).
+  # Kept as core-only so the host still builds until it is decommissioned.
  imports = [
    ./core.nix
-    ../modules/hermes
  ];
 }
Author	SHA1	Message	Date
fen	68317127ba	goyplex-vm: disable k3s network-policy controller (kube-router fwmark 0x20000 collides with netbird routing-peer mark 0x1bd20; no NetworkPolicies in use)	2026-09-09 20:29:43 -05:00
poslop	53b6e300d2	core: add netbird package	2026-09-05 09:32:39 -05:00
poslop	223b1c52f3	goyplex-vm: add fen user (key + NOPASSWD sudo), fix rebuild.sh host, retire hermes input	2026-09-05 09:16:55 -05:00
poslop	8ac8e29256	hermes: remove module, secrets, flake input, and host entry (VM to be decommissioned)	2026-09-04 15:05:49 -05:00
poslop	804764f874	hermes: retire agent service from hermes-vm (migrated to fen-vm)	2026-09-04 15:05:23 -05:00
poslop	564b974d34	flake: update lock (nixpkgs/aquamarine bumps)	2026-09-04 15:03:26 -05:00