From aa55dc025140cdef1bd7bd1ac21c7616b7c81943 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 19 Feb 2026 13:08:11 -0600 Subject: [PATCH 01/31] host --- flake.nix | 9 +++++ hosts/nixos-vm1/configuration.nix | 42 ---------------------- hosts/nixos-vm1/hardware-configuration.nix | 34 ------------------ hosts/qemu-vm/configuration.nix | 18 ++++++++++ hosts/qemu-vm/hardware-configuration.nix | 33 +++++++++++++++++ modules/core/network.nix | 4 ++- modules/core/zsh/.zshrc | 6 ++++ rebuild.sh | 2 +- 8 files changed, 70 insertions(+), 78 deletions(-) delete mode 100644 hosts/nixos-vm1/configuration.nix delete mode 100644 hosts/nixos-vm1/hardware-configuration.nix create mode 100644 hosts/qemu-vm/configuration.nix create mode 100644 hosts/qemu-vm/hardware-configuration.nix diff --git a/flake.nix b/flake.nix index 6370c32..23d920f 100644 --- a/flake.nix +++ b/flake.nix @@ -35,6 +35,15 @@ inherit self inputs username; }; }; + + qemu-vm = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./hosts/qemu-vm/configuration.nix ]; + specialArgs = { + host = "qemu-vm"; + inherit self inputs username; + }; + }; }; }; diff --git a/hosts/nixos-vm1/configuration.nix b/hosts/nixos-vm1/configuration.nix deleted file mode 100644 index 20db7d5..0000000 --- a/hosts/nixos-vm1/configuration.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ - pkgs, - ... -}: - -{ - nix.settings = { - experimental-features = "nix-command flakes"; - }; - - imports = [ - ./hardware-configuration.nix - ./modules - ]; - - programs.hyprland.enable = true; - - boot.loader.grub.enable = true; - boot.loader.grub.device = "/dev/vda"; - networking.hostName = "poslop-nixvm"; - networking.networkmanager.enable = true; - - time.timeZone = "America/Chicago"; - - services.printing.enable = true; - - services.pipewire = { - enable = true; - pulse.enable = true; - }; - - environment.systemPackages = with pkgs; [ - kitty - vim - wget - git - curl - zsh - ]; - - system.stateVersion = "24.11"; -} diff --git a/hosts/nixos-vm1/hardware-configuration.nix b/hosts/nixos-vm1/hardware-configuration.nix deleted file mode 100644 index 9149754..0000000 --- a/hosts/nixos-vm1/hardware-configuration.nix +++ /dev/null @@ -1,34 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - lib, - modulesPath, - ... -}: - -{ - imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; - - boot.initrd.availableKernelModules = [ - "ahci" - "xhci_pci" - "virtio_pci" - "sr_mod" - "virtio_blk" - ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/39b3801f-ffcd-421f-966f-46625fb8d4ca"; - fsType = "ext4"; - }; - - swapDevices = [ { device = "/dev/disk/by-uuid/7043d338-93f0-40a7-9033-6616685e32f3"; } ]; - - networking.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} diff --git a/hosts/qemu-vm/configuration.nix b/hosts/qemu-vm/configuration.nix new file mode 100644 index 0000000..866fe4e --- /dev/null +++ b/hosts/qemu-vm/configuration.nix @@ -0,0 +1,18 @@ +{ + ... +}: + +{ + imports = [ + ./hardware-configuration.nix + ../../modules + ]; + + boot.loader.grub.enable = true; + boot.loader.grub.device = "/dev/vda"; + + services.spice-vdagentd.enable = true; + services.qemuGuest.enable = true; + + system.stateVersion = "24.11"; +} diff --git a/hosts/qemu-vm/hardware-configuration.nix b/hosts/qemu-vm/hardware-configuration.nix new file mode 100644 index 0000000..de7894a --- /dev/null +++ b/hosts/qemu-vm/hardware-configuration.nix @@ -0,0 +1,33 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_blk" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/b8c66f3c-759d-4d4f-9d1a-3f2e04d91e23"; + fsType = "ext4"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/b7d73851-7f85-44fa-b62a-e35deb0ea98a"; } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp8s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/modules/core/network.nix b/modules/core/network.nix index d30c0dc..c102531 100644 --- a/modules/core/network.nix +++ b/modules/core/network.nix @@ -1,4 +1,6 @@ +{ host, ... }: + { - networking.hostName = "poslop-nixvm2"; + networking.hostName = host; networking.networkmanager.enable = true; } diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 17f236d..69777ec 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -10,3 +10,9 @@ zstyle :compinstall filename '/home/poslop/.zshrc' autoload -Uz compinit compinit + +reflake() { + local flake_dir="/etc/rice-flakes" + host="${1:-$(hostname -s)}" + sudo nixos-rebuild switch --flake "${flake_dir}#${host}" +} diff --git a/rebuild.sh b/rebuild.sh index 60c6ba7..54d1c55 100755 --- a/rebuild.sh +++ b/rebuild.sh @@ -1 +1 @@ -sudo nixos-rebuild switch --flake ./#nixos-vm2 +sudo nixos-rebuild switch --flake ./#qemu-vm -- 2.54.0 From 98b245bbf0033359d4333421b62c3cd4fe3b66e0 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 19 Feb 2026 15:49:13 -0600 Subject: [PATCH 02/31] rename reflake to rerice --- modules/core/nvim.nix | 2 +- modules/core/zsh/.zshrc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/core/nvim.nix b/modules/core/nvim.nix index 0ad4c48..43215aa 100644 --- a/modules/core/nvim.nix +++ b/modules/core/nvim.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ pkgs, ... }: { systemd.user.services."nvim-config" = { diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 69777ec..81e0885 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -11,7 +11,7 @@ zstyle :compinstall filename '/home/poslop/.zshrc' autoload -Uz compinit compinit -reflake() { +rerice() { local flake_dir="/etc/rice-flakes" host="${1:-$(hostname -s)}" sudo nixos-rebuild switch --flake "${flake_dir}#${host}" -- 2.54.0 From 99a93326b9b06077edf45552942c28544bbdb248 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 20 Feb 2026 14:08:18 -0600 Subject: [PATCH 03/31] packages reformat --- modules/core/default.nix | 2 +- modules/core/packages/default.nix | 6 ++++++ modules/core/packages/system.nix | 7 +++++++ modules/core/{packages.nix => packages/user.nix} | 9 ++------- 4 files changed, 16 insertions(+), 8 deletions(-) create mode 100644 modules/core/packages/default.nix create mode 100644 modules/core/packages/system.nix rename modules/core/{packages.nix => packages/user.nix} (65%) diff --git a/modules/core/default.nix b/modules/core/default.nix index 258d0e0..ceb39b5 100644 --- a/modules/core/default.nix +++ b/modules/core/default.nix @@ -5,7 +5,7 @@ ./git.nix ./hjem.nix ./network.nix - ./packages.nix + ./packages ./timezone.nix ./nix.nix ./pipewire.nix diff --git a/modules/core/packages/default.nix b/modules/core/packages/default.nix new file mode 100644 index 0000000..be6d006 --- /dev/null +++ b/modules/core/packages/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./user.nix + ./system.nix + ]; +} diff --git a/modules/core/packages/system.nix b/modules/core/packages/system.nix new file mode 100644 index 0000000..b25fb19 --- /dev/null +++ b/modules/core/packages/system.nix @@ -0,0 +1,7 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + zsh + ]; + +} diff --git a/modules/core/packages.nix b/modules/core/packages/user.nix similarity index 65% rename from modules/core/packages.nix rename to modules/core/packages/user.nix index b74f0b3..b8585a7 100644 --- a/modules/core/packages.nix +++ b/modules/core/packages/user.nix @@ -1,16 +1,11 @@ -{ pkgs, username, inputs, ... }: +{ pkgs, username, ... }: { - environment.systemPackages = with pkgs; [ - zsh - ]; - hjem.users.${username}.packages = with pkgs; [ clang lld + nixfmt llvmPackages.bintools tlrc - rustc - cargo unzip neovim btop -- 2.54.0 From 011afecb6f8d67b23e6275cef6d18b32ad188547 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 17:35:33 -0500 Subject: [PATCH 04/31] goyplex-vm --- flake.nix | 9 +++++++ hosts/goyplex-vm/configuration.nix | 18 +++++++++++++ hosts/goyplex-vm/hardware-configuration.nix | 30 +++++++++++++++++++++ 3 files changed, 57 insertions(+) create mode 100644 hosts/goyplex-vm/configuration.nix create mode 100644 hosts/goyplex-vm/hardware-configuration.nix diff --git a/flake.nix b/flake.nix index 23d920f..0abdc0c 100644 --- a/flake.nix +++ b/flake.nix @@ -44,6 +44,15 @@ inherit self inputs username; }; }; + + goyplex-vm = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./hosts/goyplex-vm/configuration.nix ]; + specialArgs = { + host = "goyplex-vm"; + inherit self inputs username; + }; + }; }; }; diff --git a/hosts/goyplex-vm/configuration.nix b/hosts/goyplex-vm/configuration.nix new file mode 100644 index 0000000..afc18d7 --- /dev/null +++ b/hosts/goyplex-vm/configuration.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ../../modules + ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + services.spice-vdagentd.enable = true; + services.qemuGuest.enable = true; + + system.stateVersion = "25.11"; +} diff --git a/hosts/goyplex-vm/hardware-configuration.nix b/hosts/goyplex-vm/hardware-configuration.nix new file mode 100644 index 0000000..897045e --- /dev/null +++ b/hosts/goyplex-vm/hardware-configuration.nix @@ -0,0 +1,30 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/C838-5FC2"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} -- 2.54.0 From c86f9f4dc1f955cb04a29e7e0fbe6cddaea27866 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 17:44:45 -0500 Subject: [PATCH 05/31] renamed rum.desktops.hyprland --- modules/home/hyprland/hyprland.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/home/hyprland/hyprland.nix b/modules/home/hyprland/hyprland.nix index 9de7508..0531411 100644 --- a/modules/home/hyprland/hyprland.nix +++ b/modules/home/hyprland/hyprland.nix @@ -1,7 +1,7 @@ { programs.hyprland.enable = true; hj = { - rum.programs.hyprland.enable = true; + rum.desktops.hyprland.enable = true; files = { ".config/hypr".source = ./hypr; -- 2.54.0 From aa7520e4874c871ad16d78288d5a5e37c43832c0 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 17:53:00 -0500 Subject: [PATCH 06/31] git alias --- modules/core/zsh/.zshrc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 81e0885..b186f19 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -11,6 +11,11 @@ zstyle :compinstall filename '/home/poslop/.zshrc' autoload -Uz compinit compinit +alias ga='git add' +alias gc='git commit' +alias gp='git push' +alias gs='git status' + rerice() { local flake_dir="/etc/rice-flakes" host="${1:-$(hostname -s)}" -- 2.54.0 From 32cfdc0f3da800e65b44691d564a450ae9a72169 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:16:07 -0500 Subject: [PATCH 07/31] simplify inputs --- flake.nix | 43 ++++++++++++++++--------------------------- 1 file changed, 16 insertions(+), 27 deletions(-) diff --git a/flake.nix b/flake.nix index 0abdc0c..746073c 100644 --- a/flake.nix +++ b/flake.nix @@ -24,36 +24,25 @@ let system = "x86_64-linux"; username = "poslop"; + mkHost = + host: modules: + nixpkgs.lib.nixosSystem { + modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules; + specialArgs = { + inherit + self + inputs + username + host + ; + }; + }; in { nixosConfigurations = { - nixos-vm2 = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./hosts/nixos-vm2/configuration.nix ]; - specialArgs = { - host = "nixos-vm2"; - inherit self inputs username; - }; - }; - - qemu-vm = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./hosts/qemu-vm/configuration.nix ]; - specialArgs = { - host = "qemu-vm"; - inherit self inputs username; - }; - }; - - goyplex-vm = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./hosts/goyplex-vm/configuration.nix ]; - specialArgs = { - host = "goyplex-vm"; - inherit self inputs username; - }; - }; + nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ]; + qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ]; + goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ]; }; - }; } -- 2.54.0 From 5a7f060075b230f37549024fc0cd1c390aede04d Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:18:33 -0500 Subject: [PATCH 08/31] nixd package --- modules/core/packages/user.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/core/packages/user.nix b/modules/core/packages/user.nix index b8585a7..101e37e 100644 --- a/modules/core/packages/user.nix +++ b/modules/core/packages/user.nix @@ -4,6 +4,7 @@ clang lld nixfmt + nixd llvmPackages.bintools tlrc unzip -- 2.54.0 From 2a17c5ecdf993ad3ce219a1b5f825036524e47bd Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:30:14 -0500 Subject: [PATCH 09/31] lua ls --- modules/core/packages/user.nix | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/core/packages/user.nix b/modules/core/packages/user.nix index 101e37e..1a33cf3 100644 --- a/modules/core/packages/user.nix +++ b/modules/core/packages/user.nix @@ -1,19 +1,20 @@ { pkgs, username, ... }: { hjem.users.${username}.packages = with pkgs; [ - clang - lld - nixfmt - nixd - llvmPackages.bintools - tlrc - unzip - neovim btop + clang curl git + lld + llvmPackages.bintools + lua-language-server neofetch + neovim + nixd + nixfmt statix + tlrc + unzip wget wl-clipboard ]; -- 2.54.0 From 9e56c695f0237767ae832f8572a6f6c6d0f33cd9 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:35:15 -0500 Subject: [PATCH 10/31] ga alias -> function --- modules/core/zsh/.zshrc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index b186f19..854b395 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -11,11 +11,18 @@ zstyle :compinstall filename '/home/poslop/.zshrc' autoload -Uz compinit compinit -alias ga='git add' alias gc='git commit' alias gp='git push' alias gs='git status' +ga() { + if [[ -z "$1" ]]; then + git add -u + else + git add "$1" + fi +} + rerice() { local flake_dir="/etc/rice-flakes" host="${1:-$(hostname -s)}" -- 2.54.0 From bb19efac38967e2eb9e92639dc8d5ecc656cdc14 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:51:05 -0500 Subject: [PATCH 11/31] reorg pkgs --- modules/core/packages/default.nix | 3 ++- modules/core/packages/{user.nix => dev.nix} | 19 ++++++++++--------- modules/core/packages/utils.nix | 12 ++++++++++++ 3 files changed, 24 insertions(+), 10 deletions(-) rename modules/core/packages/{user.nix => dev.nix} (72%) create mode 100644 modules/core/packages/utils.nix diff --git a/modules/core/packages/default.nix b/modules/core/packages/default.nix index be6d006..9193ec7 100644 --- a/modules/core/packages/default.nix +++ b/modules/core/packages/default.nix @@ -1,6 +1,7 @@ { imports = [ - ./user.nix + ./dev.nix ./system.nix + ./utils.nix ]; } diff --git a/modules/core/packages/user.nix b/modules/core/packages/dev.nix similarity index 72% rename from modules/core/packages/user.nix rename to modules/core/packages/dev.nix index 1a33cf3..8a0ef3e 100644 --- a/modules/core/packages/user.nix +++ b/modules/core/packages/dev.nix @@ -1,21 +1,22 @@ { pkgs, username, ... }: { hjem.users.${username}.packages = with pkgs; [ - btop - clang - curl + # general + neovim git + + # c++ + clang lld llvmPackages.bintools + + # lua + stylua lua-language-server - neofetch - neovim + + # nix nixd nixfmt statix - tlrc - unzip - wget - wl-clipboard ]; } diff --git a/modules/core/packages/utils.nix b/modules/core/packages/utils.nix new file mode 100644 index 0000000..2bb7738 --- /dev/null +++ b/modules/core/packages/utils.nix @@ -0,0 +1,12 @@ +{ pkgs, username, ... }: +{ + hjem.users.${username}.packages = with pkgs; [ + btop + curl + neofetch + tlrc + unzip + wget + wl-clipboard + ]; +} -- 2.54.0 From 5cd20d6a35c9042b5e9f899ebe2e3ac8627ad5d9 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 24 Apr 2026 18:56:23 -0500 Subject: [PATCH 12/31] remove c++ tools --- modules/core/default.nix | 1 - modules/core/packages/dev.nix | 5 ----- modules/home/default.nix | 1 + modules/{core => home}/pipewire.nix | 0 4 files changed, 1 insertion(+), 6 deletions(-) rename modules/{core => home}/pipewire.nix (100%) diff --git a/modules/core/default.nix b/modules/core/default.nix index ceb39b5..d1be68c 100644 --- a/modules/core/default.nix +++ b/modules/core/default.nix @@ -8,7 +8,6 @@ ./packages ./timezone.nix ./nix.nix - ./pipewire.nix ./program.nix ./user.nix ./ssh.nix diff --git a/modules/core/packages/dev.nix b/modules/core/packages/dev.nix index 8a0ef3e..0318f05 100644 --- a/modules/core/packages/dev.nix +++ b/modules/core/packages/dev.nix @@ -5,11 +5,6 @@ neovim git - # c++ - clang - lld - llvmPackages.bintools - # lua stylua lua-language-server diff --git a/modules/home/default.nix b/modules/home/default.nix index 65c11b5..ec5e862 100644 --- a/modules/home/default.nix +++ b/modules/home/default.nix @@ -1,6 +1,7 @@ { imports = [ ./hyprland + ./pipewire.nix ./packages.nix ./fonts.nix ]; diff --git a/modules/core/pipewire.nix b/modules/home/pipewire.nix similarity index 100% rename from modules/core/pipewire.nix rename to modules/home/pipewire.nix -- 2.54.0 From 5f994ccf0a0dd870bcd53a3c1d04c098fff5adb3 Mon Sep 17 00:00:00 2001 From: poslop Date: Fri, 29 May 2026 20:54:22 -0500 Subject: [PATCH 13/31] hermes --- flake.lock | 233 +++++++++++++++++++- flake.nix | 14 +- hosts/goyplex-vm/hardware-configuration.nix | 45 ++-- hosts/hermes-vm/configuration.nix | 19 ++ hosts/hermes-vm/hardware-configuration.nix | 47 ++++ modules/core/zsh/.zshrc | 12 +- modules/hermes/default.nix | 6 + modules/hermes/hermes.nix | 12 + modules/hermes/sudo.nix | 13 ++ 9 files changed, 378 insertions(+), 23 deletions(-) create mode 100644 hosts/hermes-vm/configuration.nix create mode 100644 hosts/hermes-vm/hardware-configuration.nix create mode 100644 modules/hermes/default.nix create mode 100644 modules/hermes/hermes.nix create mode 100644 modules/hermes/sudo.nix diff --git a/flake.lock b/flake.lock index 33ff08e..09ad853 100644 --- a/flake.lock +++ b/flake.lock @@ -49,6 +49,27 @@ "type": "github" } }, + "flake-parts": { + "inputs": { + "nixpkgs-lib": [ + "hermes-agent", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1772408722, + "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -71,6 +92,29 @@ "type": "github" } }, + "hermes-agent": { + "inputs": { + "flake-parts": "flake-parts", + "nixpkgs": "nixpkgs", + "npm-lockfile-fix": "npm-lockfile-fix", + "pyproject-build-systems": "pyproject-build-systems", + "pyproject-nix": "pyproject-nix_2", + "uv2nix": "uv2nix_2" + }, + "locked": { + "lastModified": 1780086628, + "narHash": "sha256-+O+2ecAWOSiIkCBPgXh8c5Uq5RUZIycnXqiYnRWyxJA=", + "owner": "NousResearch", + "repo": "hermes-agent", + "rev": "689ef5e233980f5d5a32080e959f44c8991dd03a", + "type": "github" + }, + "original": { + "owner": "NousResearch", + "repo": "hermes-agent", + "type": "github" + } + }, "hjem": { "inputs": { "nix-darwin": "nix-darwin", @@ -208,7 +252,7 @@ "hyprutils": "hyprutils", "hyprwayland-scanner": "hyprwayland-scanner", "hyprwire": "hyprwire", - "nixpkgs": "nixpkgs_2", + "nixpkgs": "nixpkgs_3", "pre-commit-hooks": "pre-commit-hooks", "systems": "systems_2", "xdph": "xdph" @@ -460,7 +504,7 @@ }, "ndg": { "inputs": { - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs_2" }, "locked": { "lastModified": 1766342086, @@ -499,6 +543,22 @@ } }, "nixpkgs": { + "locked": { + "lastModified": 1775036866, + "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { "locked": { "lastModified": 1766070988, "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=", @@ -514,7 +574,7 @@ "type": "github" } }, - "nixpkgs_2": { + "nixpkgs_3": { "locked": { "lastModified": 1767379071, "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=", @@ -530,7 +590,7 @@ "type": "github" } }, - "nixpkgs_3": { + "nixpkgs_4": { "locked": { "lastModified": 1769170682, "narHash": "sha256-oMmN1lVQU0F0W2k6OI3bgdzp2YOHWYUAw79qzDSjenU=", @@ -546,7 +606,7 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_5": { "locked": { "lastModified": 1768127708, "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=", @@ -562,6 +622,27 @@ "type": "github" } }, + "npm-lockfile-fix": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1775903712, + "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=", + "owner": "jeslie0", + "repo": "npm-lockfile-fix", + "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8", + "type": "github" + }, + "original": { + "owner": "jeslie0", + "repo": "npm-lockfile-fix", + "type": "github" + } + }, "pre-commit-hooks": { "inputs": { "flake-compat": "flake-compat", @@ -585,12 +666,101 @@ "type": "github" } }, + "pyproject-build-systems": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "nixpkgs" + ], + "pyproject-nix": "pyproject-nix", + "uv2nix": "uv2nix" + }, + "locked": { + "lastModified": 1772555609, + "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "c37f66a953535c394244888598947679af231863", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, + "pyproject-nix": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "pyproject-build-systems", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1769936401, + "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=", + "owner": "nix-community", + "repo": "pyproject.nix", + "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "pyproject.nix", + "type": "github" + } + }, + "pyproject-nix_2": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1772865871, + "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "e537db02e72d553cea470976b9733581bcf5b3ed", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, + "pyproject-nix_3": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "uv2nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1771518446, + "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, "root": { "inputs": { + "hermes-agent": "hermes-agent", "hjem": "hjem", "hjem-rum": "hjem-rum", "hyprland": "hyprland", - "nixpkgs": "nixpkgs_3", + "nixpkgs": "nixpkgs_4", "zen-browser": "zen-browser" } }, @@ -690,6 +860,55 @@ "type": "github" } }, + "uv2nix": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "pyproject-build-systems", + "nixpkgs" + ], + "pyproject-nix": [ + "hermes-agent", + "pyproject-build-systems", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1770770348, + "narHash": "sha256-A2GzkmzdYvdgmMEu5yxW+xhossP+txrYb7RuzRaqhlg=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "5d1b2cb4fe3158043fbafbbe2e46238abbc954b0", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, + "uv2nix_2": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "nixpkgs" + ], + "pyproject-nix": "pyproject-nix_3" + }, + "locked": { + "lastModified": 1773039484, + "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, "xdph": { "inputs": { "hyprland-protocols": [ @@ -734,7 +953,7 @@ "zen-browser": { "inputs": { "home-manager": "home-manager", - "nixpkgs": "nixpkgs_4" + "nixpkgs": "nixpkgs_5" }, "locked": { "lastModified": 1769491693, diff --git a/flake.nix b/flake.nix index 746073c..35cca8b 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,9 @@ { inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + hyprland.url = "github:hyprwm/Hyprland"; + hermes-agent.url = "github:NousResearch/hermes-agent"; hjem = { url = "github:feel-co/hjem"; @@ -17,10 +19,16 @@ zen-browser = { url = "github:0xc000022070/zen-browser-flake"; }; + }; outputs = - { self, nixpkgs, ... }@inputs: + { + self, + nixpkgs, + hermes-agent, + ... + }@inputs: let system = "x86_64-linux"; username = "poslop"; @@ -43,6 +51,10 @@ nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ]; qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ]; goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ]; + hermes-vm = mkHost "hermes-vm" [ + hermes-agent.nixosModules.default + ./hosts/hermes-vm/configuration.nix + ]; }; }; } diff --git a/hosts/goyplex-vm/hardware-configuration.nix b/hosts/goyplex-vm/hardware-configuration.nix index 897045e..a97c9d6 100644 --- a/hosts/goyplex-vm/hardware-configuration.nix +++ b/hosts/goyplex-vm/hardware-configuration.nix @@ -1,28 +1,45 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/C838-5FC2"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/C838-5FC2"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/hosts/hermes-vm/configuration.nix b/hosts/hermes-vm/configuration.nix new file mode 100644 index 0000000..9203c1e --- /dev/null +++ b/hosts/hermes-vm/configuration.nix @@ -0,0 +1,19 @@ +{ pkgs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ../../modules + ../../modules/hermes + ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + services.spice-vdagentd.enable = true; + services.qemuGuest.enable = true; + + system.stateVersion = "25.11"; +} diff --git a/hosts/hermes-vm/hardware-configuration.nix b/hosts/hermes-vm/hardware-configuration.nix new file mode 100644 index 0000000..a97c9d6 --- /dev/null +++ b/hosts/hermes-vm/hardware-configuration.nix @@ -0,0 +1,47 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ + config, + lib, + pkgs, + modulesPath, + ... +}: + +{ + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb"; + fsType = "ext4"; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/C838-5FC2"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 854b395..bf24491 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -25,6 +25,16 @@ ga() { rerice() { local flake_dir="/etc/rice-flakes" - host="${1:-$(hostname -s)}" + local host="$(hostname -s)" + local OPTIND=1 + + while getopts ":h:" opt; do + case $opt in + h) host="$OPTARG" ;; + :) echo "Option -$OPTARG requires an argument." >&2; return 1 ;; + \?) echo "Unknown option: -$OPTARG" >&2; return 1 ;; + esac + done + sudo nixos-rebuild switch --flake "${flake_dir}#${host}" } diff --git a/modules/hermes/default.nix b/modules/hermes/default.nix new file mode 100644 index 0000000..f9dc820 --- /dev/null +++ b/modules/hermes/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./sudo.nix + ./hermes.nix + ]; +} diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix new file mode 100644 index 0000000..0517db2 --- /dev/null +++ b/modules/hermes/hermes.nix @@ -0,0 +1,12 @@ +{ + services.hermes-agent = { + enable = true; + addToSystemPackages = true; + container = { + enable = true; + hostUsers = [ "poslop" ]; + }; + + settings.model.base_url = "http://10.0.1.139:5000/v1"; + }; +} diff --git a/modules/hermes/sudo.nix b/modules/hermes/sudo.nix new file mode 100644 index 0000000..cb8b5c6 --- /dev/null +++ b/modules/hermes/sudo.nix @@ -0,0 +1,13 @@ +{ + security.sudo.extraRules = [ + { + users = [ "poslop" ]; + commands = [ + { + command = "/run/current-system/sw/bin/docker"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; +} -- 2.54.0 From b661acc7f1383cb3df062d11c54c1ab8408089a8 Mon Sep 17 00:00:00 2001 From: poslop Date: Sat, 30 May 2026 19:48:59 -0500 Subject: [PATCH 14/31] hermes memory --- .gitignore | 0 flake.lock | 120 +++++++++++++++++++++++--- flake.nix | 7 +- modules/core/nvim.nix | 2 + modules/hermes/default.nix | 1 + modules/hermes/hermes.nix | 39 ++++++++- modules/hermes/secrets/agenix.nix | 15 ++++ modules/hermes/secrets/default.nix | 5 ++ modules/hermes/secrets/hermes-env.age | Bin 0 -> 367 bytes modules/hermes/secrets/secrets.nix | 6 ++ 10 files changed, 177 insertions(+), 18 deletions(-) create mode 100644 .gitignore create mode 100644 modules/hermes/secrets/agenix.nix create mode 100644 modules/hermes/secrets/default.nix create mode 100644 modules/hermes/secrets/hermes-env.age create mode 100644 modules/hermes/secrets/secrets.nix diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e69de29 diff --git a/flake.lock b/flake.lock index 09ad853..8c9ef1e 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,26 @@ { "nodes": { + "agenix": { + "inputs": { + "darwin": "darwin", + "home-manager": "home-manager", + "nixpkgs": "nixpkgs", + "systems": "systems" + }, + "locked": { + "lastModified": 1770165109, + "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", + "owner": "ryantm", + "repo": "agenix", + "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", + "type": "github" + }, + "original": { + "owner": "ryantm", + "repo": "agenix", + "type": "github" + } + }, "aquamarine": { "inputs": { "hyprutils": [ @@ -33,6 +54,28 @@ "type": "github" } }, + "darwin": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1744478979, + "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", + "owner": "lnl7", + "repo": "nix-darwin", + "rev": "43975d782b418ebf4969e9ccba82466728c2851b", + "type": "github" + }, + "original": { + "owner": "lnl7", + "ref": "master", + "repo": "nix-darwin", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -95,7 +138,7 @@ "hermes-agent": { "inputs": { "flake-parts": "flake-parts", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_2", "npm-lockfile-fix": "npm-lockfile-fix", "pyproject-build-systems": "pyproject-build-systems", "pyproject-nix": "pyproject-nix_2", @@ -163,6 +206,27 @@ } }, "home-manager": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1745494811, + "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "home-manager_2": { "inputs": { "nixpkgs": [ "zen-browser", @@ -252,9 +316,9 @@ "hyprutils": "hyprutils", "hyprwayland-scanner": "hyprwayland-scanner", "hyprwire": "hyprwire", - "nixpkgs": "nixpkgs_3", + "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks", - "systems": "systems_2", + "systems": "systems_3", "xdph": "xdph" }, "locked": { @@ -504,7 +568,7 @@ }, "ndg": { "inputs": { - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1766342086, @@ -543,6 +607,22 @@ } }, "nixpkgs": { + "locked": { + "lastModified": 1754028485, + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { "locked": { "lastModified": 1775036866, "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=", @@ -558,7 +638,7 @@ "type": "github" } }, - "nixpkgs_2": { + "nixpkgs_3": { "locked": { "lastModified": 1766070988, "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=", @@ -574,7 +654,7 @@ "type": "github" } }, - "nixpkgs_3": { + "nixpkgs_4": { "locked": { "lastModified": 1767379071, "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=", @@ -590,7 +670,7 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_5": { "locked": { "lastModified": 1769170682, "narHash": "sha256-oMmN1lVQU0F0W2k6OI3bgdzp2YOHWYUAw79qzDSjenU=", @@ -606,7 +686,7 @@ "type": "github" } }, - "nixpkgs_5": { + "nixpkgs_6": { "locked": { "lastModified": 1768127708, "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=", @@ -756,11 +836,12 @@ }, "root": { "inputs": { + "agenix": "agenix", "hermes-agent": "hermes-agent", "hjem": "hjem", "hjem-rum": "hjem-rum", "hyprland": "hyprland", - "nixpkgs": "nixpkgs_4", + "nixpkgs": "nixpkgs_5", "zen-browser": "zen-browser" } }, @@ -793,7 +874,7 @@ "nixpkgs" ], "rust-overlay": "rust-overlay", - "systems": "systems" + "systems": "systems_2" }, "locked": { "lastModified": 1763430012, @@ -825,6 +906,21 @@ } }, "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_3": { "locked": { "lastModified": 1689347949, "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", @@ -952,8 +1048,8 @@ }, "zen-browser": { "inputs": { - "home-manager": "home-manager", - "nixpkgs": "nixpkgs_5" + "home-manager": "home-manager_2", + "nixpkgs": "nixpkgs_6" }, "locked": { "lastModified": 1769491693, diff --git a/flake.nix b/flake.nix index 35cca8b..cd009ad 100644 --- a/flake.nix +++ b/flake.nix @@ -4,6 +4,7 @@ hyprland.url = "github:hyprwm/Hyprland"; hermes-agent.url = "github:NousResearch/hermes-agent"; + agenix.url = "github:ryantm/agenix"; hjem = { url = "github:feel-co/hjem"; @@ -26,7 +27,6 @@ { self, nixpkgs, - hermes-agent, ... }@inputs: let @@ -51,10 +51,7 @@ nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ]; qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ]; goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ]; - hermes-vm = mkHost "hermes-vm" [ - hermes-agent.nixosModules.default - ./hosts/hermes-vm/configuration.nix - ]; + hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ]; }; }; } diff --git a/modules/core/nvim.nix b/modules/core/nvim.nix index 43215aa..e6a07f9 100644 --- a/modules/core/nvim.nix +++ b/modules/core/nvim.nix @@ -1,6 +1,8 @@ { pkgs, ... }: { + environment.variables.EDITOR = "nvim"; + systemd.user.services."nvim-config" = { description = "Clone Neovim config into ~/.config/nvim"; after = [ "network.target" ]; diff --git a/modules/hermes/default.nix b/modules/hermes/default.nix index f9dc820..b68e8b4 100644 --- a/modules/hermes/default.nix +++ b/modules/hermes/default.nix @@ -2,5 +2,6 @@ imports = [ ./sudo.nix ./hermes.nix + ./secrets ]; } diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 0517db2..076b429 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -1,12 +1,49 @@ +{ inputs, config, ... }: + { + imports = [ inputs.hermes-agent.nixosModules.default ]; + services.hermes-agent = { enable = true; addToSystemPackages = true; + extraDependencyGroups = [ + "messaging" + "bedrock" + ]; + environmentFiles = [ + config.age.secrets.hermes-env.path + ]; container = { + image = "debian:bookworm"; + backend = "docker"; enable = true; hostUsers = [ "poslop" ]; }; - settings.model.base_url = "http://10.0.1.139:5000/v1"; + settings = { + model = { + default = "Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf"; + provider = "local"; + }; + + memory = { + memory_enabled = true; + user_profile_enabled = true; + }; + + model_aliases = { + bedrock = { + model = "us.anthropic.claude-sonnet-4-6"; + provider = "bedrock"; + }; + }; + + custom_providers = [ + { + name = "local"; + base_url = "http://10.0.1.139:5000/v1"; + } + ]; + }; }; } diff --git a/modules/hermes/secrets/agenix.nix b/modules/hermes/secrets/agenix.nix new file mode 100644 index 0000000..182b916 --- /dev/null +++ b/modules/hermes/secrets/agenix.nix @@ -0,0 +1,15 @@ +{ + inputs, + pkgs, + username, + ... +}: + +{ + imports = [ inputs.agenix.nixosModules.default ]; + age.secrets."hermes-env".file = ./hermes-env.age; + + hjem.users.${username}.packages = with pkgs; [ + inputs.agenix.packages."${system}".default + ]; +} diff --git a/modules/hermes/secrets/default.nix b/modules/hermes/secrets/default.nix new file mode 100644 index 0000000..6d00db9 --- /dev/null +++ b/modules/hermes/secrets/default.nix @@ -0,0 +1,5 @@ +{ + imports = [ + ./agenix.nix + ]; +} diff --git a/modules/hermes/secrets/hermes-env.age b/modules/hermes/secrets/hermes-env.age new file mode 100644 index 0000000000000000000000000000000000000000..1e0660bfe87684e0971b7912f2d352119039979b GIT binary patch literal 367 zcmV-#0g(P-XJsvAZewzJaCB*JZZ2 Date: Tue, 2 Jun 2026 01:01:50 -0500 Subject: [PATCH 15/31] mod --- modules/hermes/hermes.nix | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 076b429..070992d 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -1,4 +1,9 @@ -{ inputs, config, ... }: +{ + inputs, + config, + pkgs, + ... +}: { imports = [ inputs.hermes-agent.nixosModules.default ]; @@ -6,13 +11,11 @@ services.hermes-agent = { enable = true; addToSystemPackages = true; - extraDependencyGroups = [ - "messaging" - "bedrock" - ]; + package = inputs.hermes-agent.packages.${pkgs.system}.full; environmentFiles = [ config.age.secrets.hermes-env.path ]; + container = { image = "debian:bookworm"; backend = "docker"; @@ -22,10 +25,16 @@ settings = { model = { - default = "Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf"; + #default = "Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf"; provider = "local"; }; + approvals = { + mode = "off"; + cron_mode = "deny"; + mcp_reload_confirm = "false"; + }; + memory = { memory_enabled = true; user_profile_enabled = true; @@ -41,7 +50,7 @@ custom_providers = [ { name = "local"; - base_url = "http://10.0.1.139:5000/v1"; + base_url = "http://10.0.1.139:42069/v1"; } ]; }; -- 2.54.0 From 015de3eade41a53322272b538ab99d0ef573246d Mon Sep 17 00:00:00 2001 From: poslop Date: Wed, 3 Jun 2026 20:08:53 -0500 Subject: [PATCH 16/31] packages and update --- flake.lock | 289 +++++++++----------------- modules/core/packages/dev.nix | 2 + modules/core/packages/utils.nix | 1 - modules/hermes/secrets/hermes-env.age | Bin 367 -> 367 bytes 4 files changed, 98 insertions(+), 194 deletions(-) diff --git a/flake.lock b/flake.lock index 8c9ef1e..c06c450 100644 --- a/flake.lock +++ b/flake.lock @@ -41,11 +41,11 @@ ] }, "locked": { - "lastModified": 1767024902, - "narHash": "sha256-sMdk6QkMDhIOnvULXKUM8WW8iyi551SWw2i6KQHbrrU=", + "lastModified": 1778857089, + "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "b8a0c5ba5a9fbd2c660be7dd98bdde0ff3798556", + "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8", "type": "github" }, "original": { @@ -145,11 +145,11 @@ "uv2nix": "uv2nix_2" }, "locked": { - "lastModified": 1780086628, - "narHash": "sha256-+O+2ecAWOSiIkCBPgXh8c5Uq5RUZIycnXqiYnRWyxJA=", + "lastModified": 1780529046, + "narHash": "sha256-UvnNgoUoPJdFguPmSAmBej6Zdis6pf4UquEMSH+j+Xg=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "689ef5e233980f5d5a32080e959f44c8991dd03a", + "rev": "5c0a1fec0c14bb21a09512f485683e4f41fa0e62", "type": "github" }, "original": { @@ -163,15 +163,14 @@ "nix-darwin": "nix-darwin", "nixpkgs": [ "nixpkgs" - ], - "smfh": "smfh" + ] }, "locked": { - "lastModified": 1769053318, - "narHash": "sha256-cKETEBrseo7Iz+bOzflwy1xTpDuUj3QaLA+P49yJw8k=", + "lastModified": 1780199518, + "narHash": "sha256-NhtWx0youXYRvcqtL+sjdqoZinMcnjcwRsh6eBJUZLg=", "owner": "feel-co", "repo": "hjem", - "rev": "9d0c8d4b44f661910595b07e6480557644c1431c", + "rev": "ffa433dd86e761de45ef985d4293f31a4d2a775d", "type": "github" }, "original": { @@ -185,18 +184,17 @@ "hjem": [ "hjem" ], - "ndg": "ndg", + "nix-darwin": "nix-darwin_2", "nixpkgs": [ "nixpkgs" - ], - "treefmt-nix": "treefmt-nix" + ] }, "locked": { - "lastModified": 1766394058, - "narHash": "sha256-P+59TbVusYqdx2Jt2liwvQ+hslUzU6M1ezRDy6c66Tc=", + "lastModified": 1779599065, + "narHash": "sha256-L35xnhNcCJIHTkwmpey/sBFZMnPm2eD9Ha4NCwWuy68=", "owner": "snugnug", "repo": "hjem-rum", - "rev": "edac54b7d57ad72cc4b124da2f44e7b2e584f3c6", + "rev": "e04efc81865f68f541471186090cc703d99bc62d", "type": "github" }, "original": { @@ -234,11 +232,11 @@ ] }, "locked": { - "lastModified": 1768434960, - "narHash": "sha256-cJbFn17oyg6qAraLr+NVeNJrXsrzJdrudkzI4H2iTcg=", + "lastModified": 1780099287, + "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=", "owner": "nix-community", "repo": "home-manager", - "rev": "b4d88c9ac42ae1a745283f6547701da43b6e9f9b", + "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d", "type": "github" }, "original": { @@ -263,11 +261,11 @@ ] }, "locked": { - "lastModified": 1753964049, - "narHash": "sha256-lIqabfBY7z/OANxHoPeIrDJrFyYy9jAM4GQLzZ2feCM=", + "lastModified": 1776511930, + "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=", "owner": "hyprwm", "repo": "hyprcursor", - "rev": "44e91d467bdad8dcf8bbd2ac7cf49972540980a5", + "rev": "39435900785d0c560c6ae8777d29f28617d031ef", "type": "github" }, "original": { @@ -292,11 +290,11 @@ ] }, "locked": { - "lastModified": 1766946335, - "narHash": "sha256-MRD+Jr2bY11MzNDfenENhiK6pvN+nHygxdHoHbZ1HtE=", + "lastModified": 1776426399, + "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "4af02a3925b454deb1c36603843da528b67ded6c", + "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", "type": "github" }, "original": { @@ -316,17 +314,17 @@ "hyprutils": "hyprutils", "hyprwayland-scanner": "hyprwayland-scanner", "hyprwire": "hyprwire", - "nixpkgs": "nixpkgs_4", + "nixpkgs": "nixpkgs_3", "pre-commit-hooks": "pre-commit-hooks", - "systems": "systems_3", + "systems": "systems_2", "xdph": "xdph" }, "locked": { - "lastModified": 1769548913, - "narHash": "sha256-b9WwbhMj/MmUSSiZOeBbwlpDRXac+hdZRBSG2QTk2ew=", + "lastModified": 1780519208, + "narHash": "sha256-Ic3I/mnmsT1HPew7owqDsJ8NxRV9HOWu8zpG6aeKH78=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "c8b5023bb0610be4d1d2987ef05168834b2661ba", + "rev": "04435fb857d4e3c5845bc43b077568d28e048c54", "type": "github" }, "original": { @@ -368,11 +366,11 @@ ] }, "locked": { - "lastModified": 1767023960, - "narHash": "sha256-R2HgtVS1G3KSIKAQ77aOZ+Q0HituOmPgXW9nBNkpp3Q=", + "lastModified": 1776426575, + "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "c2e906261142f5dd1ee0bfc44abba23e2754c660", + "rev": "a968d211048e3ed538e47b84cb3649299578f19d", "type": "github" }, "original": { @@ -393,11 +391,11 @@ ] }, "locked": { - "lastModified": 1765214753, - "narHash": "sha256-P9zdGXOzToJJgu5sVjv7oeOGPIIwrd9hAUAP3PsmBBs=", + "lastModified": 1772460177, + "narHash": "sha256-/6G/MsPvtn7bc4Y32pserBT/Z4SUUdBd4XYJpOEKVR4=", "owner": "hyprwm", "repo": "hyprland-protocols", - "rev": "3f3860b869014c00e8b9e0528c7b4ddc335c21ab", + "rev": "1cb6db5fd6bb8aee419f4457402fa18293ace917", "type": "github" }, "original": { @@ -422,11 +420,11 @@ ] }, "locked": { - "lastModified": 1764612430, - "narHash": "sha256-54ltTSbI6W+qYGMchAgCR6QnC1kOdKXN6X6pJhOWxFg=", + "lastModified": 1777320127, + "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=", "owner": "hyprwm", "repo": "hyprlang", - "rev": "0d00dc118981531aa731150b6ea551ef037acddd", + "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc", "type": "github" }, "original": { @@ -474,11 +472,11 @@ ] }, "locked": { - "lastModified": 1764592794, - "narHash": "sha256-7CcO+wbTJ1L1NBQHierHzheQGPWwkIQug/w+fhTAVuU=", + "lastModified": 1772462885, + "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "5cfe0743f0e608e1462972303778d8a0859ee63e", + "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998", "type": "github" }, "original": { @@ -499,11 +497,11 @@ ] }, "locked": { - "lastModified": 1766253372, - "narHash": "sha256-1+p4Kw8HdtMoFSmJtfdwjxM4bPxDK9yg27SlvUMpzWA=", + "lastModified": 1779475241, + "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "51a4f93ce8572e7b12b7284eb9e6e8ebf16b4be9", + "rev": "3cd3972b2ee658a14d2610d8494e09259e530124", "type": "github" }, "original": { @@ -524,11 +522,11 @@ ] }, "locked": { - "lastModified": 1763640274, - "narHash": "sha256-Uan1Nl9i4TF/kyFoHnTq1bd/rsWh4GAK/9/jDqLbY5A=", + "lastModified": 1777159683, + "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=", "owner": "hyprwm", "repo": "hyprwayland-scanner", - "rev": "f6cf414ca0e16a4d30198fd670ec86df3c89f671", + "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404", "type": "github" }, "original": { @@ -553,11 +551,11 @@ ] }, "locked": { - "lastModified": 1767473322, - "narHash": "sha256-RGOeG+wQHeJ6BKcsSB8r0ZU77g9mDvoQzoTKj2dFHwA=", + "lastModified": 1778410714, + "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=", "owner": "hyprwm", "repo": "hyprwire", - "rev": "d5e7d6b49fe780353c1cf9a1cf39fa8970bd9d11", + "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc", "type": "github" }, "original": { @@ -566,25 +564,6 @@ "type": "github" } }, - "ndg": { - "inputs": { - "nixpkgs": "nixpkgs_3" - }, - "locked": { - "lastModified": 1766342086, - "narHash": "sha256-vKuCSU8BCUxG8S2/EyOXrCbIQjmY07Jb5Cq3ehnLsnY=", - "owner": "feel-co", - "repo": "ndg", - "rev": "696647a8f0ea1451c02de21b6bdf2a2c9f238d85", - "type": "github" - }, - "original": { - "owner": "feel-co", - "ref": "v2.5.1", - "repo": "ndg", - "type": "github" - } - }, "nix-darwin": { "inputs": { "nixpkgs": [ @@ -593,11 +572,32 @@ ] }, "locked": { - "lastModified": 1765065051, - "narHash": "sha256-b7W9WsvyMOkUScNxbzS45KEJp0iiqRPyJ1I3JBE+oEE=", + "lastModified": 1777780666, + "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=", "owner": "nix-darwin", "repo": "nix-darwin", - "rev": "7e22bf538aa3e0937effcb1cee73d5f1bcc26f79", + "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777", + "type": "github" + }, + "original": { + "owner": "nix-darwin", + "repo": "nix-darwin", + "type": "github" + } + }, + "nix-darwin_2": { + "inputs": { + "nixpkgs": [ + "hjem-rum", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1779036909, + "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=", + "owner": "nix-darwin", + "repo": "nix-darwin", + "rev": "56c666e108467d87d13508936aade6d567f2a501", "type": "github" }, "original": { @@ -640,11 +640,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1766070988, - "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=", + "lastModified": 1779357205, + "narHash": "sha256-cCO8aTqss5x9Ky8GWkpY0Hy5fyTZEbtifSUV8QjSzic=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8", + "rev": "f83fc3c307e74bc5fd5adb7eb6b8b13ffd2a36e1", "type": "github" }, "original": { @@ -656,15 +656,15 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1767379071, - "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=", - "owner": "NixOS", + "lastModified": 1780243769, + "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "owner": "nixos", "repo": "nixpkgs", - "rev": "fb7944c166a3b630f177938e478f0378e64ce108", + "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "nixos", "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" @@ -672,27 +672,11 @@ }, "nixpkgs_5": { "locked": { - "lastModified": 1769170682, - "narHash": "sha256-oMmN1lVQU0F0W2k6OI3bgdzp2YOHWYUAw79qzDSjenU=", + "lastModified": 1779560665, + "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", "owner": "nixos", "repo": "nixpkgs", - "rev": "c5296fdd05cfa2c187990dd909864da9658df755", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_6": { - "locked": { - "lastModified": 1768127708, - "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38", + "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", "type": "github" }, "original": { @@ -733,11 +717,11 @@ ] }, "locked": { - "lastModified": 1767281941, - "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=", + "lastModified": 1778507602, + "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa", + "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", "type": "github" }, "original": { @@ -841,55 +825,10 @@ "hjem": "hjem", "hjem-rum": "hjem-rum", "hyprland": "hyprland", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_4", "zen-browser": "zen-browser" } }, - "rust-overlay": { - "inputs": { - "nixpkgs": [ - "hjem", - "smfh", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1763347184, - "narHash": "sha256-6QH8hpCYJxifvyHEYg+Da0BotUn03BwLIvYo3JAxuqQ=", - "owner": "oxalica", - "repo": "rust-overlay", - "rev": "08895cce80433978d5bfd668efa41c5e24578cbd", - "type": "github" - }, - "original": { - "owner": "oxalica", - "repo": "rust-overlay", - "type": "github" - } - }, - "smfh": { - "inputs": { - "nixpkgs": [ - "hjem", - "nixpkgs" - ], - "rust-overlay": "rust-overlay", - "systems": "systems_2" - }, - "locked": { - "lastModified": 1763430012, - "narHash": "sha256-06G7pXUdpMnUqR0JWWvV7sA8oNGOZU1cSLqQS1GMf7Y=", - "owner": "feel-co", - "repo": "smfh", - "rev": "eddda76e3dd4c6deaea5f819f174fc16dbe70f90", - "type": "github" - }, - "original": { - "owner": "feel-co", - "repo": "smfh", - "type": "github" - } - }, "systems": { "locked": { "lastModified": 1681028828, @@ -906,21 +845,6 @@ } }, "systems_2": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "systems_3": { "locked": { "lastModified": 1689347949, "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", @@ -935,27 +859,6 @@ "type": "github" } }, - "treefmt-nix": { - "inputs": { - "nixpkgs": [ - "hjem-rum", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1746216483, - "narHash": "sha256-4h3s1L/kKqt3gMDcVfN8/4v2jqHrgLIe4qok4ApH5x4=", - "owner": "numtide", - "repo": "treefmt-nix", - "rev": "29ec5026372e0dec56f890e50dbe4f45930320fd", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "treefmt-nix", - "type": "github" - } - }, "uv2nix": { "inputs": { "nixpkgs": [ @@ -1033,11 +936,11 @@ ] }, "locked": { - "lastModified": 1761431178, - "narHash": "sha256-xzjC1CV3+wpUQKNF+GnadnkeGUCJX+vgaWIZsnz9tzI=", + "lastModified": 1778265244, + "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "4b8801228ff958d028f588f0c2b911dbf32297f9", + "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968", "type": "github" }, "original": { @@ -1049,14 +952,14 @@ "zen-browser": { "inputs": { "home-manager": "home-manager_2", - "nixpkgs": "nixpkgs_6" + "nixpkgs": "nixpkgs_5" }, "locked": { - "lastModified": 1769491693, - "narHash": "sha256-bbqeCDML1yXI6kpy8q8BshKRV1szk3xV0StAbzw4Z+o=", + "lastModified": 1780512239, + "narHash": "sha256-hRHaK71WF/UK2ka6uoHPXmbUPNh8pUf+Da47134O348=", "owner": "0xc000022070", "repo": "zen-browser-flake", - "rev": "708e0f10aba5de7d0f55883d06fa08aa6a7cd462", + "rev": "735371d9ccc5c9bd7981df54fe9adbb6be666965", "type": "github" }, "original": { diff --git a/modules/core/packages/dev.nix b/modules/core/packages/dev.nix index 0318f05..ee70dcc 100644 --- a/modules/core/packages/dev.nix +++ b/modules/core/packages/dev.nix @@ -4,6 +4,8 @@ # general neovim git + tree-sitter + gcc # lua stylua diff --git a/modules/core/packages/utils.nix b/modules/core/packages/utils.nix index 2bb7738..e16056b 100644 --- a/modules/core/packages/utils.nix +++ b/modules/core/packages/utils.nix @@ -3,7 +3,6 @@ hjem.users.${username}.packages = with pkgs; [ btop curl - neofetch tlrc unzip wget diff --git a/modules/hermes/secrets/hermes-env.age b/modules/hermes/secrets/hermes-env.age index 1e0660bfe87684e0971b7912f2d352119039979b..130e2b00e23333e145b8925c04e38ea1f069c214 100644 GIT binary patch delta 332 zcmV-S0ki(^0`CHlEPq&9V>3i(K~GmpZ)apoP)9FqXlr6^d1F#mQ7=$$QDs7FMo>&) zY*#gCFbY&sP;^sTLSs`eYGPDkXmm$WO>Hn#Q*vQ&IW$dGb!AO+MQ~X-Nk=eQFbXX# zEg)ffXGc^wcPmzUZ8kG=c{XxOa7jTgQh8QzG&XQ&c}-$iHGgd{c~LoTY%~gLS8xY! z1@hF&Nqfh_IyP1iSRGYNuX9-C{-Db%dYS$8InAj$sZ$Sj62PcV(k7HLY3FLnPLdP&g@G` e3CCY#TO^FTlX{c-=C%|+R)a$+Z2e&&ZEG^ki-%hP delta 332 zcmV-S0ki(^0`CHlEPrBeG*~inL~mL`Z)Q(HXE|4Eb3su|Fj_ftPj@S8OG;)pNkmL( zOl4|VMGAUBbvIg7HBB;Ya#J~DF?VY*Q!r{|FHKZNW^GheP%}9~VJ}l?Vt7h1RSGRF zEg*1tb8L4wQ8apTZ$?EjP&9N Date: Thu, 9 Jul 2026 10:15:06 -0500 Subject: [PATCH 17/31] hermes changes --- flake.lock | 161 +++++++------------------- flake.nix | 5 - modules/core/user.nix | 5 +- modules/core/zsh/.zshrc | 2 + modules/hermes/hermes.nix | 52 ++++++++- modules/hermes/secrets/hermes-env.age | Bin 367 -> 799 bytes modules/home/packages.nix | 2 - 7 files changed, 93 insertions(+), 134 deletions(-) diff --git a/flake.lock b/flake.lock index c06c450..aa4af4f 100644 --- a/flake.lock +++ b/flake.lock @@ -41,11 +41,11 @@ ] }, "locked": { - "lastModified": 1778857089, - "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=", + "lastModified": 1782073106, + "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8", + "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457", "type": "github" }, "original": { @@ -145,11 +145,11 @@ "uv2nix": "uv2nix_2" }, "locked": { - "lastModified": 1780529046, - "narHash": "sha256-UvnNgoUoPJdFguPmSAmBej6Zdis6pf4UquEMSH+j+Xg=", + "lastModified": 1783122776, + "narHash": "sha256-Qvtj2AGQKdXrV5u7Z8hxNEDXKaeovZvX2Z2cjZKItPA=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "5c0a1fec0c14bb21a09512f485683e4f41fa0e62", + "rev": "5445e42b87b9918d5b1bfa9f4eadd8e4bb10ff37", "type": "github" }, "original": { @@ -160,17 +160,16 @@ }, "hjem": { "inputs": { - "nix-darwin": "nix-darwin", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1780199518, - "narHash": "sha256-NhtWx0youXYRvcqtL+sjdqoZinMcnjcwRsh6eBJUZLg=", + "lastModified": 1782267080, + "narHash": "sha256-so1hIImuLtTKTVUokJ/6C2D2b2D4znCx+/PAjMSAnpw=", "owner": "feel-co", "repo": "hjem", - "rev": "ffa433dd86e761de45ef985d4293f31a4d2a775d", + "rev": "dd0ba9e22fb46581f843e6121de33ca7a4a80224", "type": "github" }, "original": { @@ -184,17 +183,17 @@ "hjem": [ "hjem" ], - "nix-darwin": "nix-darwin_2", + "nix-darwin": "nix-darwin", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1779599065, - "narHash": "sha256-L35xnhNcCJIHTkwmpey/sBFZMnPm2eD9Ha4NCwWuy68=", + "lastModified": 1782226699, + "narHash": "sha256-xSafE2wgqjunLwrxPYEiTvOUDMy2PjFxDpzw8uqDWL4=", "owner": "snugnug", "repo": "hjem-rum", - "rev": "e04efc81865f68f541471186090cc703d99bc62d", + "rev": "c9e1ee9cccc13f462f874d81f6cb97f2a4293afa", "type": "github" }, "original": { @@ -224,27 +223,6 @@ "type": "github" } }, - "home-manager_2": { - "inputs": { - "nixpkgs": [ - "zen-browser", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1780099287, - "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=", - "owner": "nix-community", - "repo": "home-manager", - "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "home-manager", - "type": "github" - } - }, "hyprcursor": { "inputs": { "hyprlang": [ @@ -290,11 +268,11 @@ ] }, "locked": { - "lastModified": 1776426399, - "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", + "lastModified": 1782566056, + "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", + "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8", "type": "github" }, "original": { @@ -320,11 +298,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1780519208, - "narHash": "sha256-Ic3I/mnmsT1HPew7owqDsJ8NxRV9HOWu8zpG6aeKH78=", + "lastModified": 1783110106, + "narHash": "sha256-PRnnFkTfQ+sQHSrcWw0512zEMNp5/1WHJeVuDf6FmxI=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "04435fb857d4e3c5845bc43b077568d28e048c54", + "rev": "14fa1fd0273973b7a40966b4fa9e081d6bf67dae", "type": "github" }, "original": { @@ -366,11 +344,11 @@ ] }, "locked": { - "lastModified": 1776426575, - "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", + "lastModified": 1782563850, + "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "a968d211048e3ed538e47b84cb3649299578f19d", + "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178", "type": "github" }, "original": { @@ -472,11 +450,11 @@ ] }, "locked": { - "lastModified": 1772462885, - "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=", + "lastModified": 1782554491, + "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998", + "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35", "type": "github" }, "original": { @@ -497,11 +475,11 @@ ] }, "locked": { - "lastModified": 1779475241, - "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=", + "lastModified": 1783002634, + "narHash": "sha256-xGqHIUK0wIZoW7SiMalwvO6uGOO/VrlQwoRobpE7dDI=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "3cd3972b2ee658a14d2610d8494e09259e530124", + "rev": "41fb809557abd29a57151b6e1aaeabd05f9437e1", "type": "github" }, "original": { @@ -565,27 +543,6 @@ } }, "nix-darwin": { - "inputs": { - "nixpkgs": [ - "hjem", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1777780666, - "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=", - "owner": "nix-darwin", - "repo": "nix-darwin", - "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777", - "type": "github" - }, - "original": { - "owner": "nix-darwin", - "repo": "nix-darwin", - "type": "github" - } - }, - "nix-darwin_2": { "inputs": { "nixpkgs": [ "hjem-rum", @@ -640,11 +597,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1779357205, - "narHash": "sha256-cCO8aTqss5x9Ky8GWkpY0Hy5fyTZEbtifSUV8QjSzic=", + "lastModified": 1782467914, + "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f83fc3c307e74bc5fd5adb7eb6b8b13ffd2a36e1", + "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", "type": "github" }, "original": { @@ -656,27 +613,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1782959384, + "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_5": { - "locked": { - "lastModified": 1779560665, - "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", + "rev": "65179426c83bb3f6bc14898b42ea1c6f01d374b0", "type": "github" }, "original": { @@ -717,11 +658,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -825,8 +766,7 @@ "hjem": "hjem", "hjem-rum": "hjem-rum", "hyprland": "hyprland", - "nixpkgs": "nixpkgs_4", - "zen-browser": "zen-browser" + "nixpkgs": "nixpkgs_4" } }, "systems": { @@ -936,11 +876,11 @@ ] }, "locked": { - "lastModified": 1778265244, - "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=", + "lastModified": 1782311043, + "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968", + "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a", "type": "github" }, "original": { @@ -948,25 +888,6 @@ "repo": "xdg-desktop-portal-hyprland", "type": "github" } - }, - "zen-browser": { - "inputs": { - "home-manager": "home-manager_2", - "nixpkgs": "nixpkgs_5" - }, - "locked": { - "lastModified": 1780512239, - "narHash": "sha256-hRHaK71WF/UK2ka6uoHPXmbUPNh8pUf+Da47134O348=", - "owner": "0xc000022070", - "repo": "zen-browser-flake", - "rev": "735371d9ccc5c9bd7981df54fe9adbb6be666965", - "type": "github" - }, - "original": { - "owner": "0xc000022070", - "repo": "zen-browser-flake", - "type": "github" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index cd009ad..65dd8a0 100644 --- a/flake.nix +++ b/flake.nix @@ -16,11 +16,6 @@ inputs.nixpkgs.follows = "nixpkgs"; inputs.hjem.follows = "hjem"; }; - - zen-browser = { - url = "github:0xc000022070/zen-browser-flake"; - }; - }; outputs = diff --git a/modules/core/user.nix b/modules/core/user.nix index 72bbdc2..b5e290f 100644 --- a/modules/core/user.nix +++ b/modules/core/user.nix @@ -4,7 +4,10 @@ users.users.${username} = { isNormalUser = true; description = "${username}"; - extraGroups = [ "wheel" ]; + extraGroups = [ + "wheel" + "docker" + ]; shell = pkgs.zsh; }; nix.settings.allowed-users = [ "@wheel" ]; diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index bf24491..9503e9d 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -15,6 +15,8 @@ alias gc='git commit' alias gp='git push' alias gs='git status' +alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key' + ga() { if [[ -z "$1" ]]; then git add -u diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 070992d..40828a3 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -2,6 +2,7 @@ inputs, config, pkgs, + username, ... }: @@ -11,7 +12,6 @@ services.hermes-agent = { enable = true; addToSystemPackages = true; - package = inputs.hermes-agent.packages.${pkgs.system}.full; environmentFiles = [ config.age.secrets.hermes-env.path ]; @@ -21,14 +21,15 @@ backend = "docker"; enable = true; hostUsers = [ "poslop" ]; + extraOptions = [ + "-p" + "9119:9119" + "-p" + "8642:8642" + ]; }; settings = { - model = { - #default = "Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf"; - provider = "local"; - }; - approvals = { mode = "off"; cron_mode = "deny"; @@ -47,12 +48,51 @@ }; }; + bedrock = { + discovery = { + enable = true; + provider_filter = [ "anthropic" ]; + }; + }; + custom_providers = [ { name = "local"; base_url = "http://10.0.1.139:42069/v1"; } ]; + + discord = { + group_sessions_per_user = false; + reactions = false; + }; + + dashboard = { + basic_auth = { + username = "poslop"; + password_hash = "scrypt$16384$8$1$XpurTBPYAwR7lqHEXjmudg==$1tKObL9EWptqLNHjCyTX+phYB7Qp0RuIgF2X8C/jO0A="; + }; + }; + }; + }; + + networking.firewall.allowedTCPPorts = [ + 9119 + 8642 + ]; + + systemd.services.hermes-dashboard = { + description = "Hermes Agent Web Dashboard"; + after = [ "hermes-agent.service" ]; + bindsTo = [ "hermes-agent.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open"; + Restart = "on-failure"; + RestartSec = 5; + StartLimitIntervalSec = 60; + StartLimitBurst = 3; }; }; } diff --git a/modules/hermes/secrets/hermes-env.age b/modules/hermes/secrets/hermes-env.age index 130e2b00e23333e145b8925c04e38ea1f069c214..1583299daf7985e512b8e829a2af83cbe44e30ed 100644 GIT binary patch delta 767 zcmVV-`IHQn$@G^D00OTc~p5R}Pvw zvi)JekQPKNPno@Hd(Gy`%w0+%a!+xq_{l-j_EXvb*?(TbU>tn+TkK?uT6J}wbk?UZ zOT{6DdSb<$3P8=YFDl-^XIO(x5Ff>zHVY7l(iK;QL@kVJD6iF27@3~%D5Yx3RV=PFIijh-+Sl!#aOQP8i|x zSK%k9NM3>BvM0&7Duvk+r-Ltt@gN|_;qWDx=6FZk9?7J~EkLTbXHu}vG2Sy2h=1TP zR9HlgqjOk`Xt&j*LVk=W6pb7@WZSa6$qr)0I;4^z_la5+G#{8R*jJOLsv8nLA*vBN xNYA=U+m#{%KxtJA`(i$zVwH;Mzy5R3i(K~GmpZ)apoP)9FqXlr6^d1F#mQ7=$$QDs7FMo>&) zY*#gCFbY&sP;^sTLSs`eYGPDkXmm$WO>Hn#Q*vQ&IW$dGb!AO+MQ~X-Nk=eQFbXX# zEg)ffXGc^wcPmzUZ8kG=c{XxOa7jTgQh8QzG&XQ&c}-$iHGgd{c~LoTY%~gLS8xY! z1@hF&Nqfh_IyP1iSRGYNuX9-C{-Db%dYS$8InAj$sZ$Sj62PcV(k7HLY3FLnPLdP&g@G` e3CCY#TO^FTlX{c-=C%|+R)a$+Z2e&&ZEG@W_lFMv diff --git a/modules/home/packages.nix b/modules/home/packages.nix index e6c19f2..ddd5622 100644 --- a/modules/home/packages.nix +++ b/modules/home/packages.nix @@ -1,13 +1,11 @@ { pkgs, username, - inputs, ... }: { hjem.users.${username}.packages = with pkgs; [ - inputs.zen-browser.packages."${system}".default kitty foot ]; -- 2.54.0 From 3651da7577ba4ea1ecf182c867aff21aa5623c30 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 9 Jul 2026 11:18:29 -0500 Subject: [PATCH 18/31] hemres permission service --- modules/hermes/hermes.nix | 46 ++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 40828a3..ccd5a6f 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -2,7 +2,6 @@ inputs, config, pkgs, - username, ... }: @@ -81,18 +80,39 @@ 8642 ]; - systemd.services.hermes-dashboard = { - description = "Hermes Agent Web Dashboard"; - after = [ "hermes-agent.service" ]; - bindsTo = [ "hermes-agent.service" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Type = "simple"; - ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open"; - Restart = "on-failure"; - RestartSec = 5; - StartLimitIntervalSec = 60; - StartLimitBurst = 3; + systemd = { + paths.hermes-perms-watch = { + description = "Watch hermes data dir for permission changes"; + wantedBy = [ "multi-user.target" ]; + pathConfig = { + PathChanged = "/var/lib/hermes/.hermes"; + Unit = "hermes-perms-fix.service"; + }; + }; + + services = { + hermes-dashboard = { + description = "Hermes Agent Web Dashboard"; + after = [ "hermes-agent.service" ]; + bindsTo = [ "hermes-agent.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open"; + Restart = "on-failure"; + RestartSec = 5; + StartLimitIntervalSec = 60; + StartLimitBurst = 3; + }; + }; + + hermes-perms-fix = { + description = "Fix hermes data dir permissions"; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.coreutils}/bin/chmod 770 -R /var/lib/hermes/.hermes"; + }; + }; }; }; } -- 2.54.0 From 6875e11f6885cff93b5b32a8f1c5898ebdfb0657 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 16 Jul 2026 08:54:41 -0500 Subject: [PATCH 19/31] updates and hermes changes --- flake.lock | 147 ++++++++------------------------------ modules/hermes/hermes.nix | 41 ++++------- 2 files changed, 46 insertions(+), 142 deletions(-) diff --git a/flake.lock b/flake.lock index aa4af4f..312e8b5 100644 --- a/flake.lock +++ b/flake.lock @@ -113,43 +113,21 @@ "type": "github" } }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "hyprland", - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, "hermes-agent": { "inputs": { "flake-parts": "flake-parts", "nixpkgs": "nixpkgs_2", "npm-lockfile-fix": "npm-lockfile-fix", "pyproject-build-systems": "pyproject-build-systems", - "pyproject-nix": "pyproject-nix_2", - "uv2nix": "uv2nix_2" + "pyproject-nix": "pyproject-nix", + "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1783122776, - "narHash": "sha256-Qvtj2AGQKdXrV5u7Z8hxNEDXKaeovZvX2Z2cjZKItPA=", + "lastModified": 1784144249, + "narHash": "sha256-Ud5AegeU8Fm+0g1czJP+8riQEw4+kuefo2yl0PLcEMw=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "5445e42b87b9918d5b1bfa9f4eadd8e4bb10ff37", + "rev": "8b209e0dd7b8e308d5b923fa80f7a72f71042636", "type": "github" }, "original": { @@ -189,11 +167,11 @@ ] }, "locked": { - "lastModified": 1782226699, - "narHash": "sha256-xSafE2wgqjunLwrxPYEiTvOUDMy2PjFxDpzw8uqDWL4=", + "lastModified": 1783395473, + "narHash": "sha256-oIIP2d7qELHfumkhHuofn7tryoAcuBwtYt0mDSyHF4s=", "owner": "snugnug", "repo": "hjem-rum", - "rev": "c9e1ee9cccc13f462f874d81f6cb97f2a4293afa", + "rev": "64e395fe298cd25279c6086c23ae53636e7dbf1f", "type": "github" }, "original": { @@ -298,11 +276,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1783110106, - "narHash": "sha256-PRnnFkTfQ+sQHSrcWw0512zEMNp5/1WHJeVuDf6FmxI=", + "lastModified": 1784118734, + "narHash": "sha256-sWiTb0IOA1MoLYfUIvGlG4Ahyu9gbtiOiCa3xz7HaRc=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "14fa1fd0273973b7a40966b4fa9e081d6bf67dae", + "rev": "d7fc7240f4efd0abac1c1f23f09b78b30b4e0782", "type": "github" }, "original": { @@ -597,11 +575,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1782467914, - "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", + "lastModified": 1783522502, + "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", + "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612", "type": "github" }, "original": { @@ -613,11 +591,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1782959384, - "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=", + "lastModified": 1784007870, + "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "65179426c83bb3f6bc14898b42ea1c6f01d374b0", + "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698", "type": "github" }, "original": { @@ -651,18 +629,17 @@ "pre-commit-hooks": { "inputs": { "flake-compat": "flake-compat", - "gitignore": "gitignore", "nixpkgs": [ "hyprland", "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1783008725, + "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", "type": "github" }, "original": { @@ -677,8 +654,14 @@ "hermes-agent", "nixpkgs" ], - "pyproject-nix": "pyproject-nix", - "uv2nix": "uv2nix" + "pyproject-nix": [ + "hermes-agent", + "pyproject-nix" + ], + "uv2nix": [ + "hermes-agent", + "uv2nix" + ] }, "locked": { "lastModified": 1772555609, @@ -695,28 +678,6 @@ } }, "pyproject-nix": { - "inputs": { - "nixpkgs": [ - "hermes-agent", - "pyproject-build-systems", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1769936401, - "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=", - "owner": "nix-community", - "repo": "pyproject.nix", - "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "pyproject.nix", - "type": "github" - } - }, - "pyproject-nix_2": { "inputs": { "nixpkgs": [ "hermes-agent", @@ -737,28 +698,6 @@ "type": "github" } }, - "pyproject-nix_3": { - "inputs": { - "nixpkgs": [ - "hermes-agent", - "uv2nix", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1771518446, - "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=", - "owner": "pyproject-nix", - "repo": "pyproject.nix", - "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937", - "type": "github" - }, - "original": { - "owner": "pyproject-nix", - "repo": "pyproject.nix", - "type": "github" - } - }, "root": { "inputs": { "agenix": "agenix", @@ -803,37 +742,13 @@ "inputs": { "nixpkgs": [ "hermes-agent", - "pyproject-build-systems", "nixpkgs" ], "pyproject-nix": [ "hermes-agent", - "pyproject-build-systems", "pyproject-nix" ] }, - "locked": { - "lastModified": 1770770348, - "narHash": "sha256-A2GzkmzdYvdgmMEu5yxW+xhossP+txrYb7RuzRaqhlg=", - "owner": "pyproject-nix", - "repo": "uv2nix", - "rev": "5d1b2cb4fe3158043fbafbbe2e46238abbc954b0", - "type": "github" - }, - "original": { - "owner": "pyproject-nix", - "repo": "uv2nix", - "type": "github" - } - }, - "uv2nix_2": { - "inputs": { - "nixpkgs": [ - "hermes-agent", - "nixpkgs" - ], - "pyproject-nix": "pyproject-nix_3" - }, "locked": { "lastModified": 1773039484, "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=", @@ -876,11 +791,11 @@ ] }, "locked": { - "lastModified": 1782311043, - "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=", + "lastModified": 1782644412, + "narHash": "sha256-/iSa/bL1QQFLv+uJ9gI0N87J8gOeZXvca7EjoPGKE6w=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a", + "rev": "c01c99fc278ec68c82e9865923088f043c7c1621", "type": "github" }, "original": { diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index ccd5a6f..9422179 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -40,27 +40,15 @@ user_profile_enabled = true; }; - model_aliases = { - bedrock = { - model = "us.anthropic.claude-sonnet-4-6"; - provider = "bedrock"; - }; + display = { + credits_notices = true; }; - bedrock = { - discovery = { - enable = true; - provider_filter = [ "anthropic" ]; - }; + delegation = { + model = "openai/gpt-5.6-luna"; + provider = "nous"; }; - custom_providers = [ - { - name = "local"; - base_url = "http://10.0.1.139:42069/v1"; - } - ]; - discord = { group_sessions_per_user = false; reactions = false; @@ -81,12 +69,12 @@ ]; systemd = { - paths.hermes-perms-watch = { - description = "Watch hermes data dir for permission changes"; - wantedBy = [ "multi-user.target" ]; - pathConfig = { - PathChanged = "/var/lib/hermes/.hermes"; - Unit = "hermes-perms-fix.service"; + timers.hermes-perms-maintenance = { + description = "Periodically fix hermes file permissions"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "10s"; + OnUnitActiveSec = "30s"; }; }; @@ -106,11 +94,12 @@ }; }; - hermes-perms-fix = { - description = "Fix hermes data dir permissions"; + hermes-perms-maintenance = { + description = "Fix hermes file permissions for gateway access"; serviceConfig = { Type = "oneshot"; - ExecStart = "${pkgs.coreutils}/bin/chmod 770 -R /var/lib/hermes/.hermes"; + ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +"; + ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +"; }; }; }; -- 2.54.0 From 336242e201c724634bbb6c9e4016491b5ec531d2 Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 11:26:28 -0500 Subject: [PATCH 20/31] hermes update --- flake.lock | 66 +++++++++++++++++++-------------------- modules/hermes/hermes.nix | 37 +++++----------------- 2 files changed, 40 insertions(+), 63 deletions(-) diff --git a/flake.lock b/flake.lock index 312e8b5..2fc079a 100644 --- a/flake.lock +++ b/flake.lock @@ -41,11 +41,11 @@ ] }, "locked": { - "lastModified": 1782073106, - "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=", + "lastModified": 1784368054, + "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457", + "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0", "type": "github" }, "original": { @@ -123,11 +123,11 @@ "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1784144249, - "narHash": "sha256-Ud5AegeU8Fm+0g1czJP+8riQEw4+kuefo2yl0PLcEMw=", + "lastModified": 1784644108, + "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "8b209e0dd7b8e308d5b923fa80f7a72f71042636", + "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d", "type": "github" }, "original": { @@ -143,11 +143,11 @@ ] }, "locked": { - "lastModified": 1782267080, - "narHash": "sha256-so1hIImuLtTKTVUokJ/6C2D2b2D4znCx+/PAjMSAnpw=", + "lastModified": 1784601896, + "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=", "owner": "feel-co", "repo": "hjem", - "rev": "dd0ba9e22fb46581f843e6121de33ca7a4a80224", + "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679", "type": "github" }, "original": { @@ -167,11 +167,11 @@ ] }, "locked": { - "lastModified": 1783395473, - "narHash": "sha256-oIIP2d7qELHfumkhHuofn7tryoAcuBwtYt0mDSyHF4s=", + "lastModified": 1784361899, + "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=", "owner": "snugnug", "repo": "hjem-rum", - "rev": "64e395fe298cd25279c6086c23ae53636e7dbf1f", + "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60", "type": "github" }, "original": { @@ -276,11 +276,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1784118734, - "narHash": "sha256-sWiTb0IOA1MoLYfUIvGlG4Ahyu9gbtiOiCa3xz7HaRc=", + "lastModified": 1784641930, + "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "d7fc7240f4efd0abac1c1f23f09b78b30b4e0782", + "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda", "type": "github" }, "original": { @@ -322,11 +322,11 @@ ] }, "locked": { - "lastModified": 1782563850, - "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=", + "lastModified": 1784196523, + "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178", + "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0", "type": "github" }, "original": { @@ -453,11 +453,11 @@ ] }, "locked": { - "lastModified": 1783002634, - "narHash": "sha256-xGqHIUK0wIZoW7SiMalwvO6uGOO/VrlQwoRobpE7dDI=", + "lastModified": 1784323413, + "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "41fb809557abd29a57151b6e1aaeabd05f9437e1", + "rev": "5f03477ab3a005ff27c527486f551883535aea2f", "type": "github" }, "original": { @@ -575,11 +575,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1783522502, - "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=", + "lastModified": 1784356753, + "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612", + "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a", "type": "github" }, "original": { @@ -591,11 +591,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1784007870, - "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=", + "lastModified": 1784497964, + "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=", "owner": "nixos", "repo": "nixpkgs", - "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698", + "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163", "type": "github" }, "original": { @@ -635,11 +635,11 @@ ] }, "locked": { - "lastModified": 1783008725, - "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", "type": "github" }, "original": { @@ -791,11 +791,11 @@ ] }, "locked": { - "lastModified": 1782644412, - "narHash": "sha256-/iSa/bL1QQFLv+uJ9gI0N87J8gOeZXvca7EjoPGKE6w=", + "lastModified": 1784371182, + "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "c01c99fc278ec68c82e9865923088f043c7c1621", + "rev": "08d99f727944dd15e4740090305e31c5fb92a50a", "type": "github" }, "original": { diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 9422179..185cb47 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -53,17 +53,11 @@ group_sessions_per_user = false; reactions = false; }; - - dashboard = { - basic_auth = { - username = "poslop"; - password_hash = "scrypt$16384$8$1$XpurTBPYAwR7lqHEXjmudg==$1tKObL9EWptqLNHjCyTX+phYB7Qp0RuIgF2X8C/jO0A="; - }; - }; }; }; networking.firewall.allowedTCPPorts = [ + 8080 9119 8642 ]; @@ -78,29 +72,12 @@ }; }; - services = { - hermes-dashboard = { - description = "Hermes Agent Web Dashboard"; - after = [ "hermes-agent.service" ]; - bindsTo = [ "hermes-agent.service" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Type = "simple"; - ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open"; - Restart = "on-failure"; - RestartSec = 5; - StartLimitIntervalSec = 60; - StartLimitBurst = 3; - }; - }; - - hermes-perms-maintenance = { - description = "Fix hermes file permissions for gateway access"; - serviceConfig = { - Type = "oneshot"; - ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +"; - ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +"; - }; + services.hermes-perms-maintenance = { + description = "Fix hermes file permissions for gateway access"; + serviceConfig = { + Type = "oneshot"; + ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +"; + ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +"; }; }; }; -- 2.54.0 From 106cf13597356b9ee1ba452337ae06c417ff82ec Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 11:26:41 -0500 Subject: [PATCH 21/31] hermes alias --- modules/core/zsh/.zshrc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 9503e9d..3274b22 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -15,6 +15,8 @@ alias gc='git commit' alias gp='git push' alias gs='git status' +alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes' + alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key' ga() { -- 2.54.0 From 9b5af62a47acec7121bb8edd37886c69dec4bcf0 Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 17:57:48 -0500 Subject: [PATCH 22/31] k3s init --- modules/k3s/k3s.nix | 26 ++++++++++++ modules/k3s/netbird/coturn.yaml | 31 +++++++++++++++ modules/k3s/netbird/ingress.yaml | 33 +++++++++++++++ modules/k3s/netbird/management.yaml | 62 +++++++++++++++++++++++++++++ modules/k3s/netbird/namespace.yaml | 4 ++ modules/k3s/netbird/relay.yaml | 45 +++++++++++++++++++++ modules/k3s/netbird/secrets.yaml | 9 +++++ modules/k3s/netbird/signal.yaml | 55 +++++++++++++++++++++++++ modules/k3s/traefik/deployment.yaml | 43 ++++++++++++++++++++ modules/k3s/traefik/namespace.yaml | 4 ++ modules/k3s/traefik/pvc.yaml | 11 +++++ modules/k3s/traefik/rbac.yaml | 38 ++++++++++++++++++ modules/k3s/traefik/service.yaml | 16 ++++++++ 13 files changed, 377 insertions(+) create mode 100644 modules/k3s/k3s.nix create mode 100644 modules/k3s/netbird/coturn.yaml create mode 100644 modules/k3s/netbird/ingress.yaml create mode 100644 modules/k3s/netbird/management.yaml create mode 100644 modules/k3s/netbird/namespace.yaml create mode 100644 modules/k3s/netbird/relay.yaml create mode 100644 modules/k3s/netbird/secrets.yaml create mode 100644 modules/k3s/netbird/signal.yaml create mode 100644 modules/k3s/traefik/deployment.yaml create mode 100644 modules/k3s/traefik/namespace.yaml create mode 100644 modules/k3s/traefik/pvc.yaml create mode 100644 modules/k3s/traefik/rbac.yaml create mode 100644 modules/k3s/traefik/service.yaml diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix new file mode 100644 index 0000000..6c86640 --- /dev/null +++ b/modules/k3s/k3s.nix @@ -0,0 +1,26 @@ +{ + networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ]; + networking.firewall.allowedUDPPorts = [ 3478 ]; + networking.firewall.allowedUDPPortRanges = [ + { from = 49152; to = 65535; } + ]; + + services.k3s = { + enable = true; + role = "server"; + manifests = { + traefik-namespace = { source = ./traefik/namespace.yaml; }; + traefik-rbac = { source = ./traefik/rbac.yaml; }; + traefik-pvc = { source = ./traefik/pvc.yaml; }; + traefik-deployment = { source = ./traefik/deployment.yaml; }; + traefik-service = { source = ./traefik/service.yaml; }; + netbird-namespace = { source = ./netbird/namespace.yaml; }; + netbird-secrets = { source = ./netbird/secrets.yaml; }; + netbird-coturn = { source = ./netbird/coturn.yaml; }; + netbird-signal = { source = ./netbird/signal.yaml; }; + netbird-management = { source = ./netbird/management.yaml; }; + netbird-relay = { source = ./netbird/relay.yaml; }; + netbird-ingress = { source = ./netbird/ingress.yaml; }; + }; + }; +} diff --git a/modules/k3s/netbird/coturn.yaml b/modules/k3s/netbird/coturn.yaml new file mode 100644 index 0000000..fa1ae0f --- /dev/null +++ b/modules/k3s/netbird/coturn.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: coturn + namespace: netbird +spec: + selector: + matchLabels: + app: coturn + template: + metadata: + labels: + app: coturn + spec: + hostNetwork: true + containers: + - name: coturn + image: coturn/coturn + args: + - --log-file=stdout + - --external-ip=archfox.org + - --listening-port=3478 + - --min-port=49152 + - --max-port=65535 + - --tls-listening-port=5349 + - --no-tls + - --no-dtls + - --realm=netbird.archfox.org + securityContext: + capabilities: + add: ["NET_BIND_SERVICE"] diff --git a/modules/k3s/netbird/ingress.yaml b/modules/k3s/netbird/ingress.yaml new file mode 100644 index 0000000..2f007a4 --- /dev/null +++ b/modules/k3s/netbird/ingress.yaml @@ -0,0 +1,33 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: netbird-management + namespace: netbird +spec: + entryPoints: + - websecure + routes: + - match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`) + kind: Rule + services: + - name: management + port: 80 + scheme: h2c + - match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`) + kind: Rule + services: + - name: management + port: 80 + - match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`) + kind: Rule + services: + - name: signal + port: 10000 + scheme: h2c + - match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`) + kind: Rule + services: + - name: relay + port: 33073 + tls: + certResolver: letsencrypt diff --git a/modules/k3s/netbird/management.yaml b/modules/k3s/netbird/management.yaml new file mode 100644 index 0000000..be1617f --- /dev/null +++ b/modules/k3s/netbird/management.yaml @@ -0,0 +1,62 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: management + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: management + template: + metadata: + labels: + app: management + spec: + containers: + - name: management + image: netbirdio/management:latest + args: + - --port=80 + - --log-file=stdout + - --log-level=info + - --disable-anonymous-metrics=false + - --single-account-mode-domain=netbird.archfox.org + - --dns-domain=netbird.archfox.org + env: + - name: NETBIRD_STORE_ENGINE + value: "sqlite" + ports: + - containerPort: 80 + volumeMounts: + - name: mgmt-data + mountPath: /var/lib/netbird + volumes: + - name: mgmt-data + persistentVolumeClaim: + claimName: mgmt-data +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: mgmt-data + namespace: netbird +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: management + namespace: netbird +spec: + selector: + app: management + ports: + - name: http + port: 80 + targetPort: 80 diff --git a/modules/k3s/netbird/namespace.yaml b/modules/k3s/netbird/namespace.yaml new file mode 100644 index 0000000..db05a13 --- /dev/null +++ b/modules/k3s/netbird/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: netbird diff --git a/modules/k3s/netbird/relay.yaml b/modules/k3s/netbird/relay.yaml new file mode 100644 index 0000000..ad8f51c --- /dev/null +++ b/modules/k3s/netbird/relay.yaml @@ -0,0 +1,45 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: relay + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: relay + template: + metadata: + labels: + app: relay + spec: + containers: + - name: relay + image: netbirdio/relay:latest + env: + - name: NB_LOG_LEVEL + value: "info" + - name: NB_LISTEN_ADDRESS + value: ":33073" + - name: NB_EXPOSED_ADDRESS + value: "rels://netbird.archfox.org:443/relay" + - name: NB_AUTH_SECRET + valueFrom: + secretKeyRef: + name: netbird-secrets + key: relay-auth-secret + ports: + - containerPort: 33073 +--- +apiVersion: v1 +kind: Service +metadata: + name: relay + namespace: netbird +spec: + selector: + app: relay + ports: + - name: relay + port: 33073 + targetPort: 33073 diff --git a/modules/k3s/netbird/secrets.yaml b/modules/k3s/netbird/secrets.yaml new file mode 100644 index 0000000..7553639 --- /dev/null +++ b/modules/k3s/netbird/secrets.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: netbird-secrets + namespace: netbird +type: Opaque +stringData: + # Generate with: openssl rand -base64 32 + relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32" diff --git a/modules/k3s/netbird/signal.yaml b/modules/k3s/netbird/signal.yaml new file mode 100644 index 0000000..f6db99b --- /dev/null +++ b/modules/k3s/netbird/signal.yaml @@ -0,0 +1,55 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: signal + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: signal + template: + metadata: + labels: + app: signal + spec: + containers: + - name: signal + image: netbirdio/signal:latest + env: + - name: COALESCE_INTERVAL + value: "5s" + ports: + - containerPort: 10000 + volumeMounts: + - name: signal-data + mountPath: /var/lib/netbird + volumes: + - name: signal-data + persistentVolumeClaim: + claimName: signal-data +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: signal-data + namespace: netbird +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: signal + namespace: netbird +spec: + selector: + app: signal + ports: + - name: grpc + port: 10000 + targetPort: 10000 diff --git a/modules/k3s/traefik/deployment.yaml b/modules/k3s/traefik/deployment.yaml new file mode 100644 index 0000000..4cca7be --- /dev/null +++ b/modules/k3s/traefik/deployment.yaml @@ -0,0 +1,43 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: traefik + namespace: traefik +spec: + replicas: 1 + selector: + matchLabels: + app: traefik + template: + metadata: + labels: + app: traefik + spec: + serviceAccountName: traefik + containers: + - name: traefik + image: traefik:v3.4 + args: + - --log.level=INFO + - --api.dashboard=true + - --entrypoints.web.address=:80 + - --entrypoints.websecure.address=:443 + - --entrypoints.web.http.redirections.entrypoint.to=websecure + - --entrypoints.web.http.redirections.entrypoint.scheme=https + - --providers.kubernetescrd=true + - --providers.kubernetesingress=true + - --certificatesresolvers.letsencrypt.acme.email=poslop@archfox.org + - --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json + - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web + ports: + - name: web + containerPort: 80 + - name: websecure + containerPort: 443 + volumeMounts: + - name: acme-storage + mountPath: /data + volumes: + - name: acme-storage + persistentVolumeClaim: + claimName: traefik-acme diff --git a/modules/k3s/traefik/namespace.yaml b/modules/k3s/traefik/namespace.yaml new file mode 100644 index 0000000..c088a91 --- /dev/null +++ b/modules/k3s/traefik/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: traefik diff --git a/modules/k3s/traefik/pvc.yaml b/modules/k3s/traefik/pvc.yaml new file mode 100644 index 0000000..46187de --- /dev/null +++ b/modules/k3s/traefik/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: traefik-acme + namespace: traefik +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 128Mi diff --git a/modules/k3s/traefik/rbac.yaml b/modules/k3s/traefik/rbac.yaml new file mode 100644 index 0000000..4d937e8 --- /dev/null +++ b/modules/k3s/traefik/rbac.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: traefik + namespace: traefik +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: traefik +rules: + - apiGroups: [""] + resources: ["services", "endpoints", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: ["extensions", "networking.k8s.io"] + resources: ["ingresses", "ingressclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: ["extensions", "networking.k8s.io"] + resources: ["ingresses/status"] + verbs: ["update"] + - apiGroups: ["traefik.io"] + resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", + "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices", + "serverstransports", "serverstransporttcps"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: traefik +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: traefik +subjects: + - kind: ServiceAccount + name: traefik + namespace: traefik diff --git a/modules/k3s/traefik/service.yaml b/modules/k3s/traefik/service.yaml new file mode 100644 index 0000000..04377c8 --- /dev/null +++ b/modules/k3s/traefik/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: traefik + namespace: traefik +spec: + type: LoadBalancer + selector: + app: traefik + ports: + - name: web + port: 80 + targetPort: 80 + - name: websecure + port: 443 + targetPort: 443 -- 2.54.0 From d2a688783432cc11ba9f391cbfe055522272e3ba Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 19:06:19 -0500 Subject: [PATCH 23/31] refactor(netbird): migrate to single netbird-server container --- modules/k3s/k3s.nix | 14 +++--- modules/k3s/netbird/config.yaml | 40 +++++++++++++++++ modules/k3s/netbird/coturn.yaml | 31 ------------- modules/k3s/netbird/dashboard.yaml | 56 ++++++++++++++++++++++++ modules/k3s/netbird/ingress.yaml | 23 ++++------ modules/k3s/netbird/management.yaml | 62 -------------------------- modules/k3s/netbird/relay.yaml | 45 ------------------- modules/k3s/netbird/secrets.yaml | 9 ---- modules/k3s/netbird/server.yaml | 68 +++++++++++++++++++++++++++++ modules/k3s/netbird/signal.yaml | 55 ----------------------- 10 files changed, 178 insertions(+), 225 deletions(-) create mode 100644 modules/k3s/netbird/config.yaml delete mode 100644 modules/k3s/netbird/coturn.yaml create mode 100644 modules/k3s/netbird/dashboard.yaml delete mode 100644 modules/k3s/netbird/management.yaml delete mode 100644 modules/k3s/netbird/relay.yaml delete mode 100644 modules/k3s/netbird/secrets.yaml create mode 100644 modules/k3s/netbird/server.yaml delete mode 100644 modules/k3s/netbird/signal.yaml diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix index 6c86640..1bca8d4 100644 --- a/modules/k3s/k3s.nix +++ b/modules/k3s/k3s.nix @@ -1,13 +1,11 @@ { - networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ]; + networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ]; networking.firewall.allowedUDPPorts = [ 3478 ]; - networking.firewall.allowedUDPPortRanges = [ - { from = 49152; to = 65535; } - ]; services.k3s = { enable = true; role = "server"; + extraFlags = "--write-kubeconfig-mode 644"; manifests = { traefik-namespace = { source = ./traefik/namespace.yaml; }; traefik-rbac = { source = ./traefik/rbac.yaml; }; @@ -15,11 +13,9 @@ traefik-deployment = { source = ./traefik/deployment.yaml; }; traefik-service = { source = ./traefik/service.yaml; }; netbird-namespace = { source = ./netbird/namespace.yaml; }; - netbird-secrets = { source = ./netbird/secrets.yaml; }; - netbird-coturn = { source = ./netbird/coturn.yaml; }; - netbird-signal = { source = ./netbird/signal.yaml; }; - netbird-management = { source = ./netbird/management.yaml; }; - netbird-relay = { source = ./netbird/relay.yaml; }; + netbird-config = { source = ./netbird/config.yaml; }; + netbird-server = { source = ./netbird/server.yaml; }; + netbird-dashboard = { source = ./netbird/dashboard.yaml; }; netbird-ingress = { source = ./netbird/ingress.yaml; }; }; }; diff --git a/modules/k3s/netbird/config.yaml b/modules/k3s/netbird/config.yaml new file mode 100644 index 0000000..65edc3c --- /dev/null +++ b/modules/k3s/netbird/config.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: netbird-server-config + namespace: netbird +data: + config.yaml: | + server: + listenAddress: ":80" + exposedAddress: "https://netbird.archfox.org:443" + metricsPort: 9090 + healthcheckAddress: ":9000" + logLevel: "info" + logFile: "console" + tls: + certFile: "" + keyFile: "" + letsencrypt: + enabled: false + dataDir: "" + domains: [] + email: "" + awsRoute53: false + authSecret: "CHANGE_ME_openssl_rand_-hex_32" + dataDir: "/var/lib/netbird/" + disableAnonymousMetrics: false + disableGeoliteUpdate: false + auth: + issuer: "https://netbird.archfox.org/oauth2" + localAuthDisabled: false + signKeyRefreshEnabled: true + dashboardRedirectURIs: + - "https://netbird.archfox.org/nb-auth" + - "https://netbird.archfox.org/nb-silent-auth" + cliRedirectURIs: + - "http://localhost:53000/" + store: + engine: "sqlite" + dsn: "" + encryptionKey: "" diff --git a/modules/k3s/netbird/coturn.yaml b/modules/k3s/netbird/coturn.yaml deleted file mode 100644 index fa1ae0f..0000000 --- a/modules/k3s/netbird/coturn.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: coturn - namespace: netbird -spec: - selector: - matchLabels: - app: coturn - template: - metadata: - labels: - app: coturn - spec: - hostNetwork: true - containers: - - name: coturn - image: coturn/coturn - args: - - --log-file=stdout - - --external-ip=archfox.org - - --listening-port=3478 - - --min-port=49152 - - --max-port=65535 - - --tls-listening-port=5349 - - --no-tls - - --no-dtls - - --realm=netbird.archfox.org - securityContext: - capabilities: - add: ["NET_BIND_SERVICE"] diff --git a/modules/k3s/netbird/dashboard.yaml b/modules/k3s/netbird/dashboard.yaml new file mode 100644 index 0000000..3766dfa --- /dev/null +++ b/modules/k3s/netbird/dashboard.yaml @@ -0,0 +1,56 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dashboard + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: dashboard + template: + metadata: + labels: + app: dashboard + spec: + containers: + - name: dashboard + image: netbirdio/dashboard:latest + ports: + - containerPort: 80 + env: + - name: NETBIRD_MGMT_API_ENDPOINT + value: "https://netbird.archfox.org" + - name: NETBIRD_MGMT_GRPC_API_ENDPOINT + value: "https://netbird.archfox.org" + - name: AUTH_AUDIENCE + value: "netbird-dashboard" + - name: AUTH_CLIENT_ID + value: "netbird-dashboard" + - name: AUTH_CLIENT_SECRET + value: "" + - name: AUTH_AUTHORITY + value: "https://netbird.archfox.org/oauth2" + - name: USE_AUTH0 + value: "false" + - name: AUTH_SUPPORTED_SCOPES + value: "openid profile email groups" + - name: AUTH_REDIRECT_URI + value: "/nb-auth" + - name: AUTH_SILENT_REDIRECT_URI + value: "/nb-silent-auth" + - name: LETSENCRYPT_DOMAIN + value: "none" +--- +apiVersion: v1 +kind: Service +metadata: + name: dashboard + namespace: netbird +spec: + selector: + app: dashboard + ports: + - name: http + port: 80 + targetPort: 80 diff --git a/modules/k3s/netbird/ingress.yaml b/modules/k3s/netbird/ingress.yaml index 2f007a4..213a035 100644 --- a/modules/k3s/netbird/ingress.yaml +++ b/modules/k3s/netbird/ingress.yaml @@ -1,33 +1,28 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: netbird-management + name: netbird namespace: netbird spec: entryPoints: - websecure routes: - - match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`) + - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`)) kind: Rule services: - - name: management + - name: netbird-server port: 80 scheme: h2c - - match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`) + - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`)) kind: Rule services: - - name: management + - name: netbird-server port: 80 - - match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`) + - match: Host(`netbird.archfox.org`) kind: Rule + priority: 1 services: - - name: signal - port: 10000 - scheme: h2c - - match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`) - kind: Rule - services: - - name: relay - port: 33073 + - name: dashboard + port: 80 tls: certResolver: letsencrypt diff --git a/modules/k3s/netbird/management.yaml b/modules/k3s/netbird/management.yaml deleted file mode 100644 index be1617f..0000000 --- a/modules/k3s/netbird/management.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: management - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: management - template: - metadata: - labels: - app: management - spec: - containers: - - name: management - image: netbirdio/management:latest - args: - - --port=80 - - --log-file=stdout - - --log-level=info - - --disable-anonymous-metrics=false - - --single-account-mode-domain=netbird.archfox.org - - --dns-domain=netbird.archfox.org - env: - - name: NETBIRD_STORE_ENGINE - value: "sqlite" - ports: - - containerPort: 80 - volumeMounts: - - name: mgmt-data - mountPath: /var/lib/netbird - volumes: - - name: mgmt-data - persistentVolumeClaim: - claimName: mgmt-data ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: mgmt-data - namespace: netbird -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 2Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: management - namespace: netbird -spec: - selector: - app: management - ports: - - name: http - port: 80 - targetPort: 80 diff --git a/modules/k3s/netbird/relay.yaml b/modules/k3s/netbird/relay.yaml deleted file mode 100644 index ad8f51c..0000000 --- a/modules/k3s/netbird/relay.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: relay - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: relay - template: - metadata: - labels: - app: relay - spec: - containers: - - name: relay - image: netbirdio/relay:latest - env: - - name: NB_LOG_LEVEL - value: "info" - - name: NB_LISTEN_ADDRESS - value: ":33073" - - name: NB_EXPOSED_ADDRESS - value: "rels://netbird.archfox.org:443/relay" - - name: NB_AUTH_SECRET - valueFrom: - secretKeyRef: - name: netbird-secrets - key: relay-auth-secret - ports: - - containerPort: 33073 ---- -apiVersion: v1 -kind: Service -metadata: - name: relay - namespace: netbird -spec: - selector: - app: relay - ports: - - name: relay - port: 33073 - targetPort: 33073 diff --git a/modules/k3s/netbird/secrets.yaml b/modules/k3s/netbird/secrets.yaml deleted file mode 100644 index 7553639..0000000 --- a/modules/k3s/netbird/secrets.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: netbird-secrets - namespace: netbird -type: Opaque -stringData: - # Generate with: openssl rand -base64 32 - relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32" diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml new file mode 100644 index 0000000..dde5284 --- /dev/null +++ b/modules/k3s/netbird/server.yaml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: netbird-server + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: netbird-server + template: + metadata: + labels: + app: netbird-server + spec: + containers: + - name: netbird-server + image: netbirdio/netbird-server:latest + args: ["--config", "/etc/netbird/config.yaml"] + ports: + - containerPort: 80 + - containerPort: 3478 + protocol: UDP + - containerPort: 33073 + volumeMounts: + - name: config + mountPath: /etc/netbird + - name: data + mountPath: /var/lib/netbird + volumes: + - name: config + configMap: + name: netbird-server-config + - name: data + persistentVolumeClaim: + claimName: netbird-data +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: netbird-data + namespace: netbird +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: netbird-server + namespace: netbird +spec: + selector: + app: netbird-server + ports: + - name: http + port: 80 + targetPort: 80 + - name: grpc-compat + port: 33073 + targetPort: 33073 + - name: stun + port: 3478 + targetPort: 3478 + protocol: UDP diff --git a/modules/k3s/netbird/signal.yaml b/modules/k3s/netbird/signal.yaml deleted file mode 100644 index f6db99b..0000000 --- a/modules/k3s/netbird/signal.yaml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: signal - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: signal - template: - metadata: - labels: - app: signal - spec: - containers: - - name: signal - image: netbirdio/signal:latest - env: - - name: COALESCE_INTERVAL - value: "5s" - ports: - - containerPort: 10000 - volumeMounts: - - name: signal-data - mountPath: /var/lib/netbird - volumes: - - name: signal-data - persistentVolumeClaim: - claimName: signal-data ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: signal-data - namespace: netbird -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: signal - namespace: netbird -spec: - selector: - app: signal - ports: - - name: grpc - port: 10000 - targetPort: 10000 -- 2.54.0 From 40a82aad645a5af6c164e658e7a0d60a776bb620 Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 19:28:35 -0500 Subject: [PATCH 24/31] netbird: use web entrypoint, caddy handles TLS --- modules/k3s/netbird/ingress.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/k3s/netbird/ingress.yaml b/modules/k3s/netbird/ingress.yaml index 213a035..0a8c46d 100644 --- a/modules/k3s/netbird/ingress.yaml +++ b/modules/k3s/netbird/ingress.yaml @@ -5,7 +5,7 @@ metadata: namespace: netbird spec: entryPoints: - - websecure + - web routes: - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`)) kind: Rule @@ -24,5 +24,3 @@ spec: services: - name: dashboard port: 80 - tls: - certResolver: letsencrypt -- 2.54.0 From 7af78647019b1b25cae1883a908371e177d6159c Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 20:09:28 -0500 Subject: [PATCH 25/31] traefik: remove TLS/redirect, caddy handles TLS --- modules/k3s/traefik/deployment.yaml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/modules/k3s/traefik/deployment.yaml b/modules/k3s/traefik/deployment.yaml index 4cca7be..7dcca15 100644 --- a/modules/k3s/traefik/deployment.yaml +++ b/modules/k3s/traefik/deployment.yaml @@ -21,19 +21,11 @@ spec: - --log.level=INFO - --api.dashboard=true - --entrypoints.web.address=:80 - - --entrypoints.websecure.address=:443 - - --entrypoints.web.http.redirections.entrypoint.to=websecure - - --entrypoints.web.http.redirections.entrypoint.scheme=https - --providers.kubernetescrd=true - --providers.kubernetesingress=true - - --certificatesresolvers.letsencrypt.acme.email=poslop@archfox.org - - --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json - - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web ports: - name: web containerPort: 80 - - name: websecure - containerPort: 443 volumeMounts: - name: acme-storage mountPath: /data -- 2.54.0 From 2e30fec972366bb50fb1531714d5b6913177c973 Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 20:14:35 -0500 Subject: [PATCH 26/31] traefik: add endpointslices and configmaps rbac --- modules/k3s/traefik/rbac.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/k3s/traefik/rbac.yaml b/modules/k3s/traefik/rbac.yaml index 4d937e8..95e64b1 100644 --- a/modules/k3s/traefik/rbac.yaml +++ b/modules/k3s/traefik/rbac.yaml @@ -10,7 +10,10 @@ metadata: name: traefik rules: - apiGroups: [""] - resources: ["services", "endpoints", "secrets"] + resources: ["services", "endpoints", "secrets", "configmaps"] + verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] verbs: ["get", "list", "watch"] - apiGroups: ["extensions", "networking.k8s.io"] resources: ["ingresses", "ingressclasses"] -- 2.54.0 From f42fd8684e7cef566bed92c8d82c8454030ed99a Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 20:15:00 -0500 Subject: [PATCH 27/31] traefik: add nodes, namespaces, pods to rbac --- modules/k3s/traefik/rbac.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/k3s/traefik/rbac.yaml b/modules/k3s/traefik/rbac.yaml index 95e64b1..a10b9eb 100644 --- a/modules/k3s/traefik/rbac.yaml +++ b/modules/k3s/traefik/rbac.yaml @@ -10,7 +10,7 @@ metadata: name: traefik rules: - apiGroups: [""] - resources: ["services", "endpoints", "secrets", "configmaps"] + resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"] verbs: ["get", "list", "watch"] - apiGroups: ["discovery.k8s.io"] resources: ["endpointslices"] -- 2.54.0 From fcaa0237305d638ec8707400b3fbe2e3fb8f2cc0 Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 21:18:20 -0500 Subject: [PATCH 28/31] netbird: change STUN to port 3479, add trustedHTTPProxies --- modules/k3s/k3s.nix | 2 +- modules/k3s/netbird/config.yaml | 7 ++++++- modules/k3s/netbird/server.yaml | 6 +++--- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix index 1bca8d4..8eaa99c 100644 --- a/modules/k3s/k3s.nix +++ b/modules/k3s/k3s.nix @@ -1,6 +1,6 @@ { networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ]; - networking.firewall.allowedUDPPorts = [ 3478 ]; + networking.firewall.allowedUDPPorts = [ 3479 ]; services.k3s = { enable = true; diff --git a/modules/k3s/netbird/config.yaml b/modules/k3s/netbird/config.yaml index 65edc3c..285a2b9 100644 --- a/modules/k3s/netbird/config.yaml +++ b/modules/k3s/netbird/config.yaml @@ -12,6 +12,8 @@ data: healthcheckAddress: ":9000" logLevel: "info" logFile: "console" + stunPorts: + - 3479 tls: certFile: "" keyFile: "" @@ -21,7 +23,7 @@ data: domains: [] email: "" awsRoute53: false - authSecret: "CHANGE_ME_openssl_rand_-hex_32" + authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7" dataDir: "/var/lib/netbird/" disableAnonymousMetrics: false disableGeoliteUpdate: false @@ -38,3 +40,6 @@ data: engine: "sqlite" dsn: "" encryptionKey: "" + reverseProxy: + trustedHTTPProxies: + - "10.0.1.45/32" diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml index dde5284..d03da54 100644 --- a/modules/k3s/netbird/server.yaml +++ b/modules/k3s/netbird/server.yaml @@ -19,7 +19,7 @@ spec: args: ["--config", "/etc/netbird/config.yaml"] ports: - containerPort: 80 - - containerPort: 3478 + - containerPort: 3479 protocol: UDP - containerPort: 33073 volumeMounts: @@ -63,6 +63,6 @@ spec: port: 33073 targetPort: 33073 - name: stun - port: 3478 - targetPort: 3478 + port: 3479 + targetPort: 3479 protocol: UDP -- 2.54.0 From 9a0e03657a41ad77ad3cdabeca18387f8b7319df Mon Sep 17 00:00:00 2001 From: poslop Date: Tue, 21 Jul 2026 21:25:58 -0500 Subject: [PATCH 29/31] netbird: pull encryptionKey from k8s secret --- modules/k3s/netbird/server.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml index d03da54..4b954e2 100644 --- a/modules/k3s/netbird/server.yaml +++ b/modules/k3s/netbird/server.yaml @@ -22,6 +22,12 @@ spec: - containerPort: 3479 protocol: UDP - containerPort: 33073 + env: + - name: NETBIRD_STORE_ENCRYPTION_KEY + valueFrom: + secretKeyRef: + name: netbird-encryption + key: encryptionKey volumeMounts: - name: config mountPath: /etc/netbird -- 2.54.0 From 6ab209cd5ea90df5a5f815243c97507aace30873 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 23 Jul 2026 11:15:51 -0500 Subject: [PATCH 30/31] k3s into configuration for goyplex --- hosts/goyplex-vm/configuration.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/goyplex-vm/configuration.nix b/hosts/goyplex-vm/configuration.nix index afc18d7..ec77758 100644 --- a/hosts/goyplex-vm/configuration.nix +++ b/hosts/goyplex-vm/configuration.nix @@ -4,6 +4,7 @@ imports = [ ./hardware-configuration.nix ../../modules + ../../modules/k3s/k3s.nix ]; boot.loader.systemd-boot.enable = true; -- 2.54.0 From 9698a57aa00a8780b2d270470ba2ea1f31c8a225 Mon Sep 17 00:00:00 2001 From: poslop Date: Thu, 23 Jul 2026 11:18:16 -0500 Subject: [PATCH 31/31] remove hermes permission service --- modules/hermes/hermes.nix | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index 185cb47..acdb3dc 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -1,7 +1,6 @@ { inputs, config, - pkgs, ... }: @@ -61,24 +60,4 @@ 9119 8642 ]; - - systemd = { - timers.hermes-perms-maintenance = { - description = "Periodically fix hermes file permissions"; - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = "10s"; - OnUnitActiveSec = "30s"; - }; - }; - - services.hermes-perms-maintenance = { - description = "Fix hermes file permissions for gateway access"; - serviceConfig = { - Type = "oneshot"; - ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +"; - ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +"; - }; - }; - }; } -- 2.54.0