diff --git a/hosts/unstable/hermes/default.nix b/hosts/unstable/hermes/default.nix
index a9e052c..633e891 100644
--- a/hosts/unstable/hermes/default.nix
+++ b/hosts/unstable/hermes/default.nix
@@ -9,9 +9,12 @@
     top.hermes.nixosModules.default
   ];
   greg = {
-    home = true;
-    tailscale.enable = true;
+    nebula = {
+      enable = true;
+      nebulaIp = "10.157.0.8";
+    };
   };
+  networking.hostName = "hermes";
   nix.settings = {
     sandbox = false;
   };
@@ -50,7 +53,7 @@
         context_file_max_chars = 25000;
         file_read_max_chars = 100000;
         goals = {
-          max_turns = 20;  # Number of times Hermes tells the model to keep working towards the goal
+          max_turns = 20; # Number of times Hermes tells the model to keep working towards the goal
         };
         memory = {
           memory_enabled = true;
diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix
index dc69397..e9540c8 100644
--- a/modules/nixos/home.nix
+++ b/modules/nixos/home.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -18,35 +17,9 @@ with lib;
   };
 
   config = mkIf cfg {
-    age.secrets.attic.file = ../../secrets/attic.age;
     networking.domain = "thehellings.lan";
     time.timeZone = "America/Chicago";
 
-    systemd.services.attic-client = {
-      enable = true;
-      description = "Attic client watch-store service";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "on-failure";
-        RestartSec = "5s";
-      };
-      preStart = ''
-        set -x
-        mkdir -p $XDG_CONFIG_HOME/attic
-        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
-      '';
-      script = "${pkgs.attic-client}/bin/attic watch-store --ignore-upstream-cache-filter default";
-      environment = {
-        XDG_CONFIG_HOME = "/var/lib/attic-client";
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d /var/lib/attic-client 0755 root root -"
-    ];
-
     # Open Prometheus exporter ports on LAN-connected hosts only.
     # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
     networking.firewall.allowedTCPPorts = [
diff --git a/network.json b/network.json
index 3f2da99..29bd01f 100644
--- a/network.json
+++ b/network.json
@@ -38,6 +38,7 @@
     "hermes": {
       "ip": "10.42.1.18",
       "mac": "BC:24:11:EF:3B:94",
+      "nebulaIp": "10.157.0.8",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
       "system": "x86_64-linux",
       "tags": ["server"]
diff --git a/secrets/nebula/hermes.crt b/secrets/nebula/hermes.crt
new file mode 100644
index 0000000..410543b
--- /dev/null
+++ b/secrets/nebula/hermes.crt
@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE V2-----
+MIGloD+ABmhlcm1lc6EHBAUKnQAIEIUEal/riYYEa668pYcgg4lMYGB2VakRFO6b
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIFCN4I/nO1jII+C/GwY6XVW89ddkng95yO4D
+awC9mMYng0DNzKvg2r/X1qyEBzEPu101iikgcSJeQ4X7xkA+UQo3dmXsAiZH6RSu
+ujn0TMZqZpwGP/7lUTcUEjqO7nh/o2kA
+-----END NEBULA CERTIFICATE V2-----
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index a9397ae..92b1c16 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -121,6 +121,7 @@ in
   "nebula/linode.key.age".publicKeys = everyone;
   "nebula/zeke.key.age".publicKeys = everyone;
   "nebula/exodus.key.age".publicKeys = everyone;
+  "nebula/hermes.key.age".publicKeys = everyone;
 
   # Custom files
   "lithic/cargo-config.toml.age".publicKeys = everyone;