chore: enable Hermes agent Matrix connection

hosts/unstable/hermes/default.nix

@@ -10,11 +10,16 @@
     (modulesPath + "/virtualisation/proxmox-lxc.nix")
     top.hermes.nixosModules.default
   ];
+  age.secrets.hermes = {
+    file = ../../../secrets/hermes.age;
+    owner = "hermes";
+  };
   greg = {
     nebula = {
       enable = true;
       nebulaIp = "10.157.0.8";
     };
+    nix.cache = false;
     proxies = lib.genAttrs' [ "thehellings.lan" "nebula.thehellings.com" "shire-zebra.ts.net" ] (
       name:
       (lib.nameValuePair "${config.networking.hostName}.${name}" { target = "http://127.0.0.1:9119"; })
@@ -32,6 +37,13 @@
     fstrim.enable = false;
     hermes-agent = {
       enable = true;
+      addToSystemPackages = true;
+      environment = {
+        MATRIX_HOMESERVER = "https://thehellings.com";
+      };
+      environmentFiles = [
+        config.age.secrets.hermes.path
+      ];
       settings = {
         agent = {
           reasoning_effort = "medium";
@@ -61,11 +73,24 @@
         goals = {
           max_turns = 20; # Number of times Hermes tells the model to keep working towards the goal
         };
+        matrix = {
+          allowed_users = [
+            "@greg:thehellings.com"
+          ];
+          allowed_rooms = [
+            "!agents:thehellings.com"
+          ];
+          free_response_rooms = [
+            "!agents:thehellings.com"
+          ];
+          require_mention = true;
+        };
         memory = {
           memory_enabled = true;
           user_profile_enabled = true;
           write_approval = true;
         };
+        model.default = "anthropic/claude-opus-4.8";
         quick_commands = {
           disk = {
             type = "exec";
@@ -98,9 +123,13 @@
           max_lines = 2000;
           max_line_length = 2000;
         };
+        toolsets = [ "all" ];
         worktree = true; # Enable multiple agents in the same repo
       };
     };
+    nebula.networks."nebula.thehellings.com" = {
+      tun.disable = true;
+    };
     openssh = {
       enable = true;
       openFirewall = true;

secrets/hermes.age

@@ -0,0 +1,39 @@
+age-encryption.org/v1
+-> ssh-ed25519 87huqg kPvTtHUhrETSi29FvP8KeeAbQ3X2d4gtGj2yBDjUazU
+jPc3y/RmmweltPQa+q4tV7kH+/zsyzD55tZ2hmyPL9Q
+-> ssh-ed25519 8UnW5Q EkVxRBUacXuBZF+XYxggpyWPQRAcptTk47/kAsx6hk0
+kKSWvIpbmi/q+W5/mfjSrhfBsh1AIXL8itZGwHVZcV0
+-> ssh-ed25519 UFfTmg iNN0JGAmdi5cunSM9lGy6OHzRFC1enDtkARf4h1VEE8
+61wIRoEgQxnNa0odrNFUlfAiLjCd7a+bbVBILWiB89M
+-> ssh-ed25519 KbVVUw hogkgrs7SpEMafq9zpLtCBIqgCYcuBCJiifWbGk92B0
+T6zlfhXzgqZtnXqoTiNg0zU9z8/aaMKwMDrkstB+caU
+-> ssh-ed25519 xNtnoA HlZMW2s2v3DK9o8zZISP7CqSqCL817oxBSXOzAMWXX0
+ghqv+bb0qIAhulDetfd2pHoPUyhFxpjvwktYESyUPug
+-> ssh-ed25519 aY2AXA XnOdOknu0SW/k5TtTM921BCf8vy9+6ITOsnHn9duoC0
+qZFIHN6eK+531Hgy/dgU2aY8bQGye5Qev7QS/AK+Pn4
+-> ssh-ed25519 AQhf1g Um4p+E5LPJAkiJlePY0DpwVO1gOimQQeT9jzQiQbVAQ
+FnE9sxjcZ2wGF/REND2YOORfNALWab1pqwwgBEidSdA
+-> ssh-ed25519 mOmPfg EbnYXmE9FqYJVRv937BKBtj8pJQ97/D+YyGve13MPUY
+MgE5G6frMy1r9l2pgjydodIs7f5pDCwMvah2VbbaQ4I
+-> ssh-ed25519 YJiRbw f4FUnDpiWx/14V5J3/rfTXa7I5fd+PIdzerHBeRLZRk
+acq0kWGQIsQoi/pCMCOJo9sLKsSZHjC0VYESep1exbE
+-> ssh-ed25519 Nl/5yA QveCXtwvvKeoR6+XHfYKNvAKg1QXQbP2yEeD0/Nwf3A
+D0brwh23cI7kUoPBi4PBG6D5xcY10JimYbTpYoLELas
+-> ssh-ed25519 GdLgCQ SuggiT5B+/8fT/H0rc+sl8EIOdUGpW7DBolTuv1F1lA
+TxGcIOm1usNIF5Qo0jKZn9q4pLHz6GrPu9KRpEe2tsM
+-> ssh-ed25519 tOH/HQ FVgs0aNJ4SmQxV85TXg17+qY7jxIpP63vQFOZYQAQkc
+gOz0qu6UpwNWGw0CeEzmuUnTkXCjH01FV8sPJrl2ee8
+-> ssh-ed25519 FpzvfQ J0ILvj3Rd8fHnJuLj5uf1hhAG8qbs4qpyfIWtdDVtCA
+XkK8jSX00YYd+VnVuwIl4KLOKFqJP1QH5vFCUjpbFiI
+-> ssh-ed25519 2UotMw ByDa68/UtyH5DyaLWLyiufuodexGuu5yHeK8av9Ljl0
+eJn06NTw4ALGsDQGIqjPkAGxT5gToguhQkGuXE0zGBg
+-> ssh-ed25519 kdPvzQ +iscgY0ltWv2GCQWTyxhI12SJYqMLydRW+KGdRt6Fx4
+YqJEhFni+ImPrCM8AGHCju4FKeNrpY1TkVg5Udq3KJw
+-> ssh-ed25519 onmXpg iyQ4p9Px1aI6mwCOxwDN+f7PVnDtvT9eeZpabX0lO10
+iojj8uiQi99QmaZgefLo1VktFNg1FuO943ZqWrhtHjk
+-> ssh-ed25519 CnhD0g 0mlusr7u4IfBl2PikplFHIj2p7LXD4OLOyxC+pVX930
+gHDki3Z77LaHe3o0ZQ9fkDnaEPjzkQgNGCkeahqm+s4
+-> ssh-ed25519 4ep2UA 0dNosJJwMtmlNe2yOMU8sVkY7fdYgqIo0tP3cEmEphw
+7j2rYHiOkLltsI5jMDLTYBVJFc8sA6FsaYc2uRO7W8k
+--- asIFXa+OzJT0h88Z4LgBQcNW+zsfx1trGqqrV0HGGPc
+kdãK`—ñ‰¹HwQ³ÊøÙ¸ÃM*çJ3¥áðŽi<8øå7VqD–ÐÉ·ï\Ú�H¹;ië-ÀÛ:ñ’E8>UTéÊQ½é~H(l¼ [ÍúT
×MÏ”ö‘©Vìdõñ�µ

secrets/secrets.nix

@@ -125,4 +125,6 @@ in
 
   # Custom files
   "lithic/cargo-config.toml.age".publicKeys = everyone;
+
+  "hermes.age".publicKeys = everyone;
 }