This repository has no description
configs.mailserver: add hermes@lassul.us mailbox for coaxmetal hermes
author
Hermes
committer
lassulus
date
(Oct 9, 2026, 8:03 PM CEST)
commit
e201bbdf
e201bbdf3fa02bf8ad8e2d846f65bc125ee2b28c
parent
8a761f41
8a761f41ec1f290a7a45b231461c077cb05df7b1
+47
-1
+22
configs/hermes-mail-vars.nix
+22
configs/hermes-mail-vars.nix
···
1
+
{ pkgs, ... }:
2
+
{
3
+
# Mailbox password for hermes@lassul.us. Generated once and shared: neoprism
4
+
# (configs/mailserver.nix) consumes the hash, coaxmetal
5
+
# (machines/coaxmetal/hermes.nix) the plaintext, but only at generation time
6
+
# via the hermes-env generator, so the plaintext is never deployed. Both
7
+
# machines import this file so the shared generator definition stays identical.
8
+
clan.core.vars.generators.hermes-mail = {
9
+
share = true;
10
+
files."password".deploy = false;
11
+
files."password-hash" = { };
12
+
runtimeInputs = with pkgs; [
13
+
coreutils
14
+
mkpasswd
15
+
pwgen
16
+
];
17
+
script = ''
18
+
pwgen -s 32 1 | tr -d '\n' > "$out/password"
19
+
mkpasswd -sm bcrypt < "$out/password" > "$out/password-hash"
20
+
'';
21
+
};
22
+
}
+5
configs/mailserver.nix
+5
configs/mailserver.nix
···
19
19
{
20
20
imports = [
21
21
self.inputs.nixos-mailserver.nixosModules.default
22
+
./hermes-mail-vars.nix
22
23
];
23
24
24
25
mailserver = {
···
55
56
"bot@lassul.us" = {
56
57
hashedPasswordFile =
57
58
config.clan.core.vars.generators.mailserver-bot.files."bot-mail-password-hash".path;
59
+
};
60
+
# Hermes agent on coaxmetal; shared password var, see hermes-mail-vars.nix.
61
+
"hermes@lassul.us" = {
62
+
hashedPasswordFile = config.clan.core.vars.generators.hermes-mail.files."password-hash".path;
58
63
};
59
64
};
60
65
+20
-1
machines/coaxmetal/hermes.nix
+20
-1
machines/coaxmetal/hermes.nix
···
75
75
{
76
76
imports = [
77
77
self.inputs.hermes-agent.nixosModules.default
78
+
../../configs/hermes-mail-vars.nix
78
79
];
79
80
80
81
# Hermes Agent (Nous Research) — autonomous agent run as a native systemd
···
208
209
# one-liner. Trade-off: verbose also prints full JSON args for every other
209
210
# tool call, so the channel is chattier.
210
211
settings.display.platforms.matrix.tool_progress = "verbose";
212
+
213
+
# The EMAIL_* credentials below are for mail-sending skills only. Hermes
214
+
# turns the email gateway on by itself once all four of EMAIL_ADDRESS,
215
+
# EMAIL_PASSWORD, EMAIL_IMAP_HOST and EMAIL_SMTP_HOST are set
216
+
# (gateway/config_env.py); only an explicit `enabled: false` stops that.
217
+
settings.platforms.email.enabled = false;
211
218
212
219
# Teach the agent the herd. Without this the `herdr` wrapper is just an
213
220
# unadvertised binary on PATH: nothing in the model's context would make it
···
402
409
# per-user allowlist here — the bearer token is the whole gate.
403
410
API_SERVER_ENABLED = "true";
404
411
API_SERVER_PORT = "8642";
412
+
413
+
# Mailbox hermes@lassul.us on neoprism (configs/mailserver.nix).
414
+
# EMAIL_PASSWORD comes from the shared hermes-mail var via hermes-env.
415
+
# 993 is implicit-TLS IMAP, 587 is submission with STARTTLS.
416
+
EMAIL_ADDRESS = "hermes@lassul.us";
417
+
EMAIL_IMAP_HOST = "mail.lassul.us";
418
+
EMAIL_IMAP_PORT = "993";
419
+
EMAIL_SMTP_HOST = "mail.lassul.us";
420
+
EMAIL_SMTP_PORT = "587";
405
421
};
406
422
407
-
# Secrets (MATRIX_ACCESS_TOKEN + LLAMA_API_TOKEN) come from clan vars below,
423
+
# Secrets (MATRIX_ACCESS_TOKEN, LLAMA_API_TOKEN, API_SERVER_KEY,
424
+
# EMAIL_PASSWORD) come from clan vars below,
408
425
# merged into $HERMES_HOME/.env at activation.
409
426
environmentFiles = [
410
427
config.clan.core.vars.generators.hermes-env.files."hermes.env".path
···
576
593
"hermes-api"
577
594
"radicale-hermes"
578
595
"hermes-anthropic"
596
+
"hermes-mail"
579
597
];
580
598
files."hermes.env" = { };
581
599
runtimeInputs = [ pkgs.coreutils ];
···
586
604
API_SERVER_KEY=$(cat "$in"/hermes-api/api_key)
587
605
CALDAV_PASSWORD=$(cat "$in"/radicale-hermes/password)
588
606
ANTHROPIC_TOKEN=$(cat "$in"/hermes-anthropic/oauth-token)
607
+
EMAIL_PASSWORD=$(cat "$in"/hermes-mail/password)
589
608
EOF
590
609
'';
591
610
};