jupiter: add isolated Hermes Agent instance

A separate instance from terra's, deliberately locked down harder given
jupiter's much bigger blast radius (irreplaceable immich photos on an
unredundant RAID0, gitea/CI tokens, the whole media stack): its own
dedicated "hermes" system user rather than darman (who is in jupiter's
root-equivalent docker group), container.enable = true for whole-process
containment rather than native/bare-metal, its own Telegram bot + explicit
allowlist, and no volume access to /mnt/data or this repo. stateDir/
workingDirectory live on the array (off the 29G eMMC) for future coding-task
state, guarded by RequiresMountsFor like the rest of jupiter's array-backed
services.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

darman

2026-08-19 22:46:32 +02:00

co-authored by

Claude Sonnet 5

parent 0fa567245a

commit b5fa599671

5 changed files with 100 additions and 2 deletions

									
										flake.nix
									
		+1
		
												View File
												
				@@ -85,6 +85,7 @@

				          modules = [

				            disko.nixosModules.disko

				            sops-nix.nixosModules.sops

				            inputs.hermes-agent.nixosModules.default

				            ./hosts/jupiter/configuration.nix

				          ];

				        };