{
  inputs,
  config,
  lib,
  pkgs,
  ...
}:

{
  imports = [ inputs.hermes-agent.nixosModules.default ];

  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    environmentFiles = [
      config.age.secrets.hermes-env.path
    ];

    environment = {
      BW_SERVERURL = "https://vault.archfox.org";
    };

    container = {
      image = "debian:bookworm";
      backend = "docker";
      enable = true;
      hostUsers = [ "poslop" ];
      extraOptions = [
        "-p"
        "9119:9119"
        "-p"
        "8642:8642"
        "-p"
        "9120:9120"
      ];
    };

    settings = {
      approvals = {
        mode = "off";
        cron_mode = "deny";
        mcp_reload_confirm = "false";
      };

      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
      };

      display = {
        credits_notices = true;
      };

      delegation = {
        model = "us.anthropic.claude-sonnet-5";
        provider = "bedrock";
      };

      discord = {
        group_sessions_per_user = false;
        reactions = false;
      };
    };
  };

  # Hermes serve (desktop app JSON-RPC backend, headless)
  # Port 9120 avoids conflict with the gateway's API server on 9119.
  systemd.services.hermes-serve = {
    description = "Hermes Agent Serve (desktop remote backend)";
    wantedBy = [ "multi-user.target" ];
    after = [ "hermes-agent.service" "network-online.target" ];
    wants = [ "network-online.target" ];
    requires = [ "hermes-agent.service" ];

    serviceConfig = {
      Type = "simple";
      Restart = "always";
      RestartSec = 5;
      TimeoutStopSec = 15;
    };

    script = ''
      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
        -e HERMES_HOME=/data/.hermes \
        -e HOME=/home/hermes \
        hermes-agent \
        /data/current-package/bin/hermes serve \
          --host 0.0.0.0 \
          --port 9120
    '';
  };

  # Hermes dashboard (web UI for browser access)
  # Port 9121, full web dashboard with login page.
  systemd.services.hermes-dashboard = {
    description = "Hermes Agent Dashboard (web UI)";
    wantedBy = [ "multi-user.target" ];
    after = [ "hermes-agent.service" "network-online.target" ];
    wants = [ "network-online.target" ];
    requires = [ "hermes-agent.service" ];

    serviceConfig = {
      Type = "simple";
      Restart = "always";
      RestartSec = 5;
      TimeoutStopSec = 15;
    };

    script = ''
      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
        -e HERMES_HOME=/data/.hermes \
        -e HOME=/home/hermes \
        hermes-agent \
        /data/current-package/bin/hermes dashboard \
          --host 0.0.0.0 \
          --port 9121 \
          --no-open
    '';
  };

  networking.firewall.allowedTCPPorts = [
    8080
    9119
    9120
    9121
    8642
  ];
}