This repository has no description
2configs/omnigent: serve omni.lassul.us with pocket-id login
author
lassulus
date
(Aug 13, 2026, 2:26 PM CEST)
commit
dba670b8
dba670b81880ca481390f9bdb91ba470a6ff7357
parent
19d53d7c
19d53d7c51082a4c92f025e2d7b8fced927c653b
+165
+161
2configs/omnigent.nix
+161
2configs/omnigent.nix
···
1
+
let
2
+
domain = "omni.lassul.us";
3
+
port = 8771;
4
+
stateDir = "/var/lib/omnigent";
5
+
in
6
+
{
7
+
config,
8
+
lib,
9
+
pkgs,
10
+
self,
11
+
...
12
+
}:
13
+
let
14
+
# Server-side agent catalog entry so a browser session can pick omp without
15
+
# any per-user config: the generic ACP harness drives `omp acp` (omp speaks
16
+
# the Agent Client Protocol natively). The command is unqualified on purpose
17
+
# — it is resolved on the *host* that runs the session, not here.
18
+
ompAgentConfig = pkgs.writeText "omp-config.yaml" ''
19
+
spec_version: 1
20
+
name: omp
21
+
description: Oh My Pi (omp) over ACP — runs on whichever machine hosts the session.
22
+
prompt: You are omp (Oh My Pi), a concise coding assistant.
23
+
24
+
executor:
25
+
type: omnigent
26
+
config:
27
+
harness: acp
28
+
acp_agent:
29
+
name: Oh My Pi
30
+
command: omp acp
31
+
32
+
os_env:
33
+
type: caller_process
34
+
cwd: "."
35
+
sandbox:
36
+
type: none
37
+
'';
38
+
39
+
# `--agent` takes a bundle *directory* holding config.yaml.
40
+
ompAgent = pkgs.runCommand "omnigent-agent-omp" { } ''
41
+
mkdir -p $out
42
+
cp ${ompAgentConfig} $out/config.yaml
43
+
'';
44
+
45
+
# One identity per line. Admins bypass every per-session ACL, which is what
46
+
# makes sharing manageable at all: a session's creator gets LEVEL_OWNER, and
47
+
# only owners/managers can grant others read (watch + diffs) or edit (steer).
48
+
admins = pkgs.writeText "omnigent-admins" ''
49
+
lass@lassul.us
50
+
'';
51
+
in
52
+
{
53
+
# omnigent: self-hosted agent meta-harness. The server owns sessions,
54
+
# transcripts, per-session ACLs (read / edit / manage / owner), the per-file
55
+
# diff view and the browser UI; the agents themselves run on whichever
56
+
# machine registers as a *host*, so no coding agent runs on neoprism unless
57
+
# someone points a host at it. `s covibe` in a project directory is the
58
+
# client: it runs omp locally and registers the session here.
59
+
#
60
+
# Browser auth is the local pocket-id IdP. pocket-id has no declarative
61
+
# client API, so register the client by hand at https://id.lassul.us:
62
+
# name: omnigent
63
+
# callback URL: https://omni.lassul.us/auth/callback
64
+
# logout URL: https://omni.lassul.us/
65
+
# then paste its id + secret into the clan prompt below.
66
+
67
+
# Generated cookie-signing secret plus the prompted pocket-id client
68
+
# id/secret, materialised into one EnvironmentFile.
69
+
clan.core.vars.generators.omnigent = {
70
+
files."env" = { };
71
+
prompts.oidc_client = {
72
+
description = ''
73
+
Register an OIDC client in pocket-id (https://id.lassul.us):
74
+
name: omnigent
75
+
callback URL: https://omni.lassul.us/auth/callback
76
+
Generate a client secret, then paste both lines:
77
+
OMNIGENT_OIDC_CLIENT_ID=...
78
+
OMNIGENT_OIDC_CLIENT_SECRET=...
79
+
'';
80
+
type = "multiline";
81
+
persist = true;
82
+
};
83
+
runtimeInputs = [ pkgs.openssl ];
84
+
script = ''
85
+
{
86
+
printf 'OMNIGENT_OIDC_COOKIE_SECRET=%s\n' "$(openssl rand -hex 32)"
87
+
cat "$prompts"/oidc_client
88
+
} > "$out/env"
89
+
'';
90
+
};
91
+
92
+
systemd.services.omnigent = {
93
+
description = "omnigent agent meta-harness (${domain})";
94
+
wantedBy = [ "multi-user.target" ];
95
+
after = [
96
+
"network-online.target"
97
+
"nginx.service"
98
+
];
99
+
wants = [ "network-online.target" ];
100
+
environment = {
101
+
HOME = stateDir;
102
+
OMNIGENT_AUTH_ENABLED = "1";
103
+
OMNIGENT_AUTH_PROVIDER = "oidc";
104
+
OMNIGENT_OIDC_ISSUER = "https://id.lassul.us";
105
+
OMNIGENT_OIDC_REDIRECT_URI = "https://${domain}/auth/callback";
106
+
OMNIGENT_OIDC_LOGOUT_REDIRECT_URI = "https://${domain}/";
107
+
OMNIGENT_OIDC_ALLOWED_DOMAINS = "lassul.us";
108
+
OMNIGENT_ADMIN_LIST_PATH = "${admins}";
109
+
# The wheel checks PyPI for updates on every start otherwise.
110
+
OMNIGENT_NO_UPDATE_CHECK = "1";
111
+
# Off by default upstream; be explicit, it phones home otherwise.
112
+
OMNIGENT_TELEMETRY_ENABLED = "0";
113
+
};
114
+
serviceConfig = {
115
+
ExecStart = lib.concatStringsSep " " [
116
+
(lib.getExe self.packages.${pkgs.system}.omnigent)
117
+
"server"
118
+
"--host 127.0.0.1"
119
+
"--port ${toString port}"
120
+
"--no-open"
121
+
"--database-uri sqlite:///${stateDir}/chat.db"
122
+
"--artifact-location ${stateDir}/artifacts"
123
+
"--agent ${ompAgent}"
124
+
];
125
+
EnvironmentFile = [ config.clan.core.vars.generators.omnigent.files."env".path ];
126
+
Restart = "always";
127
+
RestartSec = 5;
128
+
DynamicUser = true;
129
+
StateDirectory = "omnigent";
130
+
WorkingDirectory = stateDir;
131
+
ProtectSystem = "strict";
132
+
ProtectHome = true;
133
+
PrivateTmp = true;
134
+
NoNewPrivileges = true;
135
+
ProtectKernelTunables = true;
136
+
ProtectControlGroups = true;
137
+
RestrictAddressFamilies = [
138
+
"AF_INET"
139
+
"AF_INET6"
140
+
"AF_UNIX"
141
+
];
142
+
};
143
+
};
144
+
145
+
services.nginx.virtualHosts.${domain} = {
146
+
enableACME = true;
147
+
forceSSL = true;
148
+
locations."/" = {
149
+
proxyPass = "http://127.0.0.1:${toString port}";
150
+
# The session event stream is SSE (omnigent sets X-Accel-Buffering: no,
151
+
# which nginx honours) and the terminal/host/runner tunnels are
152
+
# WebSockets that idle between turns, so the default 60s read timeout
153
+
# would sever live sessions.
154
+
proxyWebsockets = true;
155
+
extraConfig = ''
156
+
proxy_read_timeout 1d;
157
+
proxy_send_timeout 1d;
158
+
'';
159
+
};
160
+
};
161
+
}
+1
2configs/dns/lassul.us.zone
+1
2configs/dns/lassul.us.zone
+3
machines/neoprism/config.nix
+3
machines/neoprism/config.nix