+22

configs/hermes-mail-vars.nix

View file Reviewed

··· 1 1 + { pkgs, ... }: 2 2 + { 3 3 + # Mailbox password for hermes@lassul.us. Generated once and shared: neoprism 4 4 + # (configs/mailserver.nix) consumes the hash, coaxmetal 5 5 + # (machines/coaxmetal/hermes.nix) the plaintext, but only at generation time 6 6 + # via the hermes-env generator, so the plaintext is never deployed. Both 7 7 + # machines import this file so the shared generator definition stays identical. 8 8 + clan.core.vars.generators.hermes-mail = { 9 9 + share = true; 10 10 + files."password".deploy = false; 11 11 + files."password-hash" = { }; 12 12 + runtimeInputs = with pkgs; [ 13 13 + coreutils 14 14 + mkpasswd 15 15 + pwgen 16 16 + ]; 17 17 + script = '' 18 18 + pwgen -s 32 1 | tr -d '\n' > "$out/password" 19 19 + mkpasswd -sm bcrypt < "$out/password" > "$out/password-hash" 20 20 + ''; 21 21 + }; 22 22 + }

+5

configs/mailserver.nix

View file Reviewed

··· 19 19 { 20 20 imports = [ 21 21 self.inputs.nixos-mailserver.nixosModules.default 22 22 + ./hermes-mail-vars.nix 22 23 ]; 23 24 24 25 mailserver = { ··· 55 56 "bot@lassul.us" = { 56 57 hashedPasswordFile = 57 58 config.clan.core.vars.generators.mailserver-bot.files."bot-mail-password-hash".path; 59 59 + }; 60 60 + # Hermes agent on coaxmetal; shared password var, see hermes-mail-vars.nix. 61 61 + "hermes@lassul.us" = { 62 62 + hashedPasswordFile = config.clan.core.vars.generators.hermes-mail.files."password-hash".path; 58 63 }; 59 64 }; 60 65

+20 -1

machines/coaxmetal/hermes.nix

View file Reviewed

··· 75 75 { 76 76 imports = [ 77 77 self.inputs.hermes-agent.nixosModules.default 78 78 + ../../configs/hermes-mail-vars.nix 78 79 ]; 79 80 80 81 # Hermes Agent (Nous Research) — autonomous agent run as a native systemd ··· 208 209 # one-liner. Trade-off: verbose also prints full JSON args for every other 209 210 # tool call, so the channel is chattier. 210 211 settings.display.platforms.matrix.tool_progress = "verbose"; 212 212 + 213 213 + # The EMAIL_* credentials below are for mail-sending skills only. Hermes 214 214 + # turns the email gateway on by itself once all four of EMAIL_ADDRESS, 215 215 + # EMAIL_PASSWORD, EMAIL_IMAP_HOST and EMAIL_SMTP_HOST are set 216 216 + # (gateway/config_env.py); only an explicit `enabled: false` stops that. 217 217 + settings.platforms.email.enabled = false; 211 218 212 219 # Teach the agent the herd. Without this the `herdr` wrapper is just an 213 220 # unadvertised binary on PATH: nothing in the model's context would make it ··· 402 409 # per-user allowlist here — the bearer token is the whole gate. 403 410 API_SERVER_ENABLED = "true"; 404 411 API_SERVER_PORT = "8642"; 412 412 + 413 413 + # Mailbox hermes@lassul.us on neoprism (configs/mailserver.nix). 414 414 + # EMAIL_PASSWORD comes from the shared hermes-mail var via hermes-env. 415 415 + # 993 is implicit-TLS IMAP, 587 is submission with STARTTLS. 416 416 + EMAIL_ADDRESS = "hermes@lassul.us"; 417 417 + EMAIL_IMAP_HOST = "mail.lassul.us"; 418 418 + EMAIL_IMAP_PORT = "993"; 419 419 + EMAIL_SMTP_HOST = "mail.lassul.us"; 420 420 + EMAIL_SMTP_PORT = "587"; 405 421 }; 406 422 407 407 - # Secrets (MATRIX_ACCESS_TOKEN + LLAMA_API_TOKEN) come from clan vars below, 423 423 + # Secrets (MATRIX_ACCESS_TOKEN, LLAMA_API_TOKEN, API_SERVER_KEY, 424 424 + # EMAIL_PASSWORD) come from clan vars below, 408 425 # merged into $HERMES_HOME/.env at activation. 409 426 environmentFiles = [ 410 427 config.clan.core.vars.generators.hermes-env.files."hermes.env".path ··· 576 593 "hermes-api" 577 594 "radicale-hermes" 578 595 "hermes-anthropic" 596 596 + "hermes-mail" 579 597 ]; 580 598 files."hermes.env" = { }; 581 599 runtimeInputs = [ pkgs.coreutils ]; ··· 586 604 API_SERVER_KEY=$(cat "$in"/hermes-api/api_key) 587 605 CALDAV_PASSWORD=$(cat "$in"/radicale-hermes/password) 588 606 ANTHROPIC_TOKEN=$(cat "$in"/hermes-anthropic/oauth-token) 607 607 + EMAIL_PASSWORD=$(cat "$in"/hermes-mail/password) 589 608 EOF 590 609 ''; 591 610 };