{
  inputs,
  config,
  pkgs,
  ...
}:

{
  imports = [ inputs.hermes-agent.nixosModules.default ];

  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    environmentFiles = [
      config.age.secrets.hermes-env.path
    ];

    container = {
      image = "debian:bookworm";
      backend = "docker";
      enable = true;
      hostUsers = [ "poslop" ];
      extraOptions = [
        "-p"
        "9119:9119"
        "-p"
        "8642:8642"
      ];
    };

    settings = {
      approvals = {
        mode = "off";
        cron_mode = "deny";
        mcp_reload_confirm = "false";
      };

      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
      };

      display = {
        credits_notices = true;
      };

      delegation = {
        model = "openai/gpt-5.6-luna";
        provider = "nous";
      };

      discord = {
        group_sessions_per_user = false;
        reactions = false;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [
    8080
    9119
    8642
  ];

  systemd = {
    timers.hermes-perms-maintenance = {
      description = "Periodically fix hermes file permissions";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "10s";
        OnUnitActiveSec = "30s";
      };
    };

    services.hermes-perms-maintenance = {
      description = "Fix hermes file permissions for gateway access";
      serviceConfig = {
        Type = "oneshot";
        ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +";
        ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +";
      };
    };
  };
}