This repository has no description
machines.coaxmetal.hermes: ssh through phonetpm
author
lassulus
date
(Oct 11, 2026, 10:31 AM CEST)
commit
cf447587
cf447587f7ddf4e08ce51c8a177fa611db3f183b
parent
60f8229a
60f8229a517edca83cf52c4a514c5c25837eff94
+13
+13
machines/coaxmetal/hermes.nix
+13
machines/coaxmetal/hermes.nix
···
76
76
imports = [
77
77
self.inputs.hermes-agent.nixosModules.default
78
78
../../configs/hermes-mail-vars.nix
79
+
# Phone-approved ssh for the agent: the phonetpm user service runs in the
80
+
# hermes user manager (the module sets linger), see SSH_AUTH_SOCK below.
81
+
../../configs/phonetpm.nix
79
82
];
80
83
81
84
# Hermes Agent (Nous Research) — autonomous agent run as a native systemd
···
117
120
# CalDAV (calendar skill below) is plain HTTP; curl is not otherwise on
118
121
# the gateway PATH.
119
122
pkgs.curl
123
+
# ssh through the phonetpm agent (SSH_AUTH_SOCK below).
124
+
pkgs.openssh
120
125
];
121
126
122
127
settings.model = {
···
467
472
# binary the agent is pointed at.
468
473
# The module hardens the unit with NoNewPrivileges = true, hence mkForce.
469
474
systemd.services.hermes-agent.serviceConfig.NoNewPrivileges = lib.mkForce false;
475
+
476
+
# ssh as hermes signs with the phone key (keys/ssh/phonetpm_massulus.pub,
477
+
# authorized on all hosts): every login asks for a fingerprint on the phone.
478
+
# The daemon only starts once paired:
479
+
# sudo -u hermes phonetpm pair <endpoint id>
480
+
# systemctl --user -M hermes@ start phonetpm
481
+
# %U is the hermes uid, so this is the user manager's %t/phonetpm/agent.sock.
482
+
systemd.services.hermes-agent.environment.SSH_AUTH_SOCK = "/run/user/%U/phonetpm/agent.sock";
470
483
471
484
# Boot-race guard. matrix.lassul.us is IPv6-only; on this desktop
472
485
# network-online.target can fire before v6 DNS is ready, so the gateway's