darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

add mars host, move Hermes Agent there from jupiter

Browse Source 
New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ
This commit is contained in:
darman
2026-08-22 03:00:24 +02:00
co-authored by Claude Sonnet 5
parent 9403122888
commit 7d63ba95df
18 changed files with 433 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mars/secrets.nix
+38
View File
@@ -0,0 +1,38 @@
{ config, ... }:
# sops-nix wiring for mars. Encrypted values in ../../secrets/mars.yaml,
# decrypted with mars's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
sops.defaultSopsFile = ../../secrets/mars.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets.darman_password.neededForUsers = true;
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
sops.secrets.tailscale_authkey = { };
# Credentials file for the //jupiter/data cifs mount (see configuration.nix).
# Same value as jupiter's own samba_password (services/network/samba.nix) —
# mars authenticates as the same smb user, mirroring terra's setup.
sops.secrets.samba_password = { };
sops.templates."jupiter-smb.credentials".content = ''
username=darman
password=${config.sops.placeholder.samba_password}
'';
# Hermes Agent (hermes-agent.nix) — moved here from jupiter (see that
# host's git history); same Telegram bot token, opencode key, and
# Authentik OIDC client secret, so no new bot/app to provision.
sops.secrets.opencode_go_api_key = { };
sops.secrets.telegram_bot_token = { };
sops.secrets.hermes_dashboard_oidc_client_secret = { };
sops.templates."hermes-agent.env".content = ''
OPENCODE_GO_API_KEY=${config.sops.placeholder.opencode_go_api_key}
TELEGRAM_BOT_TOKEN=${config.sops.placeholder.telegram_bot_token}
TELEGRAM_HOME_CHANNEL=15151223
TELEGRAM_ALLOWED_USERS=15151223
HERMES_DASHBOARD_OIDC_CLIENT_SECRET=${config.sops.placeholder.hermes_dashboard_oidc_client_secret}
'';
}