{
  inputs,
  config,
  pkgs,
  ...
}:

{
  imports = [ inputs.hermes-agent.nixosModules.default ];

  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    environmentFiles = [
      config.age.secrets.hermes-env.path
    ];

    container = {
      image = "debian:bookworm";
      backend = "docker";
      enable = true;
      hostUsers = [ "poslop" ];
      extraOptions = [
        "-p"
        "9119:9119"
        "-p"
        "8642:8642"
      ];
    };

    settings = {
      approvals = {
        mode = "off";
        cron_mode = "deny";
        mcp_reload_confirm = "false";
      };

      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
      };

      display = {
        credits_notices = true;
      };

      delegation = {
        model = "openai/gpt-5.6-luna";
        provider = "nous";
      };

      discord = {
        group_sessions_per_user = false;
        reactions = false;
      };

      dashboard = {
        basic_auth = {
          username = "poslop";
          password_hash = "scrypt$16384$8$1$XpurTBPYAwR7lqHEXjmudg==$1tKObL9EWptqLNHjCyTX+phYB7Qp0RuIgF2X8C/jO0A=";
        };
      };
    };
  };

  networking.firewall.allowedTCPPorts = [
    9119
    8642
  ];

  systemd = {
    timers.hermes-perms-maintenance = {
      description = "Periodically fix hermes file permissions";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "10s";
        OnUnitActiveSec = "30s";
      };
    };

    services = {
      hermes-dashboard = {
        description = "Hermes Agent Web Dashboard";
        after = [ "hermes-agent.service" ];
        bindsTo = [ "hermes-agent.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "simple";
          ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open";
          Restart = "on-failure";
          RestartSec = 5;
          StartLimitIntervalSec = 60;
          StartLimitBurst = 3;
        };
      };

      hermes-perms-maintenance = {
        description = "Fix hermes file permissions for gateway access";
        serviceConfig = {
          Type = "oneshot";
          ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +";
          ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +";
        };
      };
    };
  };
}