jupiter: add isolated Hermes Agent instance

A separate instance from terra's, deliberately locked down harder given jupiter's much bigger blast radius (irreplaceable immich photos on an unredundant RAID0, gitea/CI tokens, the whole media stack): its own dedicated "hermes" system user rather than darman (who is in jupiter's root-equivalent docker group), container.enable = true for whole-process containment rather than native/bare-metal, its own Telegram bot + explicit allowlist, and no volume access to /mnt/data or this repo. stateDir/ workingDirectory live on the array (off the 29G eMMC) for future coding-task state, guarded by RequiresMountsFor like the rest of jupiter's array-backed services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-19 22:46:32 +02:00
parent 0fa567245a
commit b5fa599671
5 changed files with 100 additions and 2 deletions
@@ -0,0 +1,77 @@
+{ config, ... }:
+
+# Hermes Agent — a SEPARATE, isolated instance from terra's
+# (services/desktop/hermes-agent.nix). Locked down harder than terra given
+# jupiter's much bigger blast radius (irreplaceable immich photos on an
+# unredundant RAID0, gitea/CI tokens, the whole media stack):
+#
+#   - Own dedicated "hermes" system user (module default: user/group "hermes",
+#     createUser = true) — NOT darman. darman is in jupiter's "docker" group
+#     (services/containers.nix: rootful podman with dockerCompat), which is
+#     root-equivalent (`docker run -v /:/host --privileged ...`). Handing an
+#     LLM-driven agent that identity would mean a container escape = root on
+#     the whole NAS.
+#   - container.enable = true, backend = "podman": the ENTIRE gateway process
+#     runs inside a container (reusing jupiter's existing rootful podman
+#     instead of also standing up a second Docker daemon), not just the shell
+#     tool. Per upstream's own SECURITY.md this is "whole-process wrapping" —
+#     shell, file tools, MCP subprocesses, and the code-exec tool are all
+#     confined, unlike the lighter "terminal-backend"-only isolation.
+#   - Its own Telegram bot (own token, in secrets.nix) with an EXPLICIT
+#     TELEGRAM_ALLOWED_USERS rather than relying solely on the adapter's
+#     fail-closed default. Sharing terra's bot token would 409-conflict two
+#     long-pollers on the same token.
+#   - No container.extraVolumes into /mnt/data or the homelab repo — nothing
+#     valuable is in reach if a command goes wrong or gets injected via
+#     Telegram/tool output. stateDir/workingDirectory live on the array
+#     (below) purely because coding-task state (repo clones, npm/pip caches
+#     inside the container's writable layer) belongs off the 29G eMMC, same
+#     reasoning as postgres/containers.storage in configuration.nix — NOT
+#     because anything else on /mnt/data is exposed to the agent.
+{
+  services.hermes-agent = {
+    enable = true;
+    addToSystemPackages = true;   # `hermes` on darman's PATH for interactive
+                                   # debugging over ssh — routes through to the
+                                   # container, does not grant darman any group.
+
+    # Off the eMMC: stateDir bind-mounts into the container as /data, so this
+    # is where any future scoped repo clone (container.extraVolumes) and the
+    # container's own writable layer (npm/pip installs during coding tasks)
+    # actually land. RequiresMountsFor below (mirrors podman/sabnzbd/gitea-runner
+    # in configuration.nix) keeps the service from starting — and bind-mounting
+    # the wrong, empty eMMC path — before the nofail array is up.
+    stateDir = "/mnt/data/AppData/hermes";
+    workingDirectory = "/mnt/data/AppData/hermes/workspaces";
+
+    container = {
+      enable = true;
+      backend = "podman";   # jupiter already runs podman (services/containers.nix);
+                             # default "docker" would stand up a second daemon.
+    };
+
+    # Same OpenCode Go provider account as terra (services/desktop/hermes-agent.nix)
+    # — just an API key, not a stateful identity like the Telegram bot token, so
+    # sharing it across hosts is fine.
+    settings.model = {
+      provider = "opencode-go";
+      base_url = "https://opencode.ai/zen/go/v1";
+      default = "gpt-5.6-luna";
+      api_mode = "codex_responses";
+    };
+
+    settings.platforms.telegram = {
+      enabled = true;
+      home_channel = {
+        platform = "telegram";
+        chat_id = "15151223";
+        name = "Erik Simon";
+        user_id = "15151223";
+      };
+    };
+
+    environmentFiles = [ config.sops.templates."hermes-agent.env".path ];
+  };
+
+  systemd.services.hermes-agent.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
+}