This repository has no description
machines.coaxmetal: Matrix for voice calls
Load the hermes-voice plugin into the gateway (matrix_dm_send, end_call,
/assist), and enable the gateway's webhook platform on 127.0.0.1:8644
with a deliver_only route to the Matrix home room, through which
hermes-voice asks approvals that no call can hear. The route is signed
with WEBHOOK_SECRET, which hermes-env fills with the API server key that
hermes-voice already holds: no new secret.
author
Hermes
committer
lassulus
date
(Oct 17, 2026, 9:13 AM CEST)
commit
f63a2e8e
f63a2e8ea18c8b1cd0464c48d5f37d3843bf2f42
parent
307216c4
307216c42c3f479721b03639f174836a99c6d5d8
+47
-6
+33
machines/coaxmetal/hermes-voice.nix
+33
machines/coaxmetal/hermes-voice.nix
···
7
7
}:
8
8
let
9
9
port = 8790;
10
+
# The gateway's webhook platform (hermes.nix), loopback only.
11
+
webhookPort = 8644;
10
12
in
11
13
{
12
14
# hermes-voice (tools/hermes-voice): live voice conversations with Hermes
···
40
42
"%d/openai-key"
41
43
"--access-token-file"
42
44
"%d/access-token"
45
+
"--matrix-webhook"
46
+
"http://127.0.0.1:${toString webhookPort}/webhooks/voice-approval"
43
47
];
44
48
LoadCredential = [
45
49
"hermes-key:${config.clan.core.vars.generators.hermes-api.files."api_key".path}"
···
70
74
# Only retiolum: neoprism's proxy and devices on the mesh. Every other
71
75
# interface keeps the default DROP (configs/default.nix).
72
76
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ port ];
77
+
78
+
# hermes-voice's side in the gateway (tools/hermes-voice/hermes-plugin): the
79
+
# matrix_dm_send and end_call tools, on for every platform like any plugin
80
+
# toolset (end_call refuses outside voice sessions), and /assist, which
81
+
# answers approvals asked in the Matrix DM through hermes-voice
82
+
# (authenticated with API_SERVER_KEY).
83
+
services.hermes-agent.extraPlugins = [
84
+
(pkgs.runCommand "hermes-voice" { } ''
85
+
cp -r ${../../tools/hermes-voice/hermes-plugin} $out
86
+
'')
87
+
];
88
+
services.hermes-agent.environment.HERMES_VOICE_URL = "http://localhost:${toString port}";
89
+
90
+
# How hermes-voice asks for an approval when no call can hear it: a
91
+
# deliver_only route posts the text to the Matrix home room through the
92
+
# gateway, no agent turn. Signed with WEBHOOK_SECRET, which is the API
93
+
# server key (hermes-env in hermes.nix), so no secret is added.
94
+
services.hermes-agent.settings.platforms.webhook = {
95
+
enabled = true;
96
+
extra = {
97
+
host = "127.0.0.1";
98
+
port = webhookPort;
99
+
routes.voice-approval = {
100
+
deliver = "matrix";
101
+
deliver_only = true;
102
+
prompt = "{text}";
103
+
};
104
+
};
105
+
};
73
106
74
107
# OpenAI project key with GPT-Live access; billed per second of open voice
75
108
# session. persist=true so the prompt value is stored once.
+14
-6
machines/coaxmetal/hermes.nix
+14
-6
machines/coaxmetal/hermes.nix
···
122
122
# recognizes plugins/homeassistant: without the marker it would see
123
123
# HASS_TOKEN, call the plugin missing, and warn on every start that it
124
124
# cannot fetch it (lazy installs are off in the sealed venv).
125
-
settings.plugins.enabled = [ "homeassistant" ];
125
+
# settings does not merge lists, so hermes-voice.nix's plugin is enabled
126
+
# here as well.
127
+
settings.plugins.enabled = [
128
+
"homeassistant"
129
+
"hermes-voice"
130
+
];
126
131
settings._left_core_installed = [ "homeassistant" ];
127
132
128
133
settings.model = {
···
343
348
MATRIX_HOMESERVER = "https://matrix.lassul.us";
344
349
MATRIX_USER_ID = "@hermes:lassul.us";
345
350
MATRIX_ALLOWED_USERS = "@lassulus:lassul.us";
346
-
# The DM with lassulus: default target for deliver=matrix (cron jobs, and
347
-
# sessions without a Matrix origin such as the voice agent on the API
348
-
# server). Without it cron delivery fails with "no delivery target
349
-
# resolved for deliver=matrix".
351
+
# The DM with lassulus: default target for deliver=matrix (cron jobs,
352
+
# the voice-approval webhook and the matrix_dm_send tool of
353
+
# hermes-voice.nix). Without it cron delivery fails with "no delivery
354
+
# target resolved for deliver=matrix".
350
355
MATRIX_HOME_ROOM = "!QSmQTYGdeExThpCqNh:lassul.us";
351
356
352
357
# The shared calendar (calendar skill above); CALDAV_PASSWORD comes from
···
387
392
388
393
# Secrets (MATRIX_ACCESS_TOKEN, LLAMA_API_TOKEN, API_SERVER_KEY,
389
394
# EMAIL_PASSWORD, HASS_TOKEN) come from clan vars below,
390
-
# merged into $HERMES_HOME/.env at activation.
395
+
# merged into $HERMES_HOME/.env at activation. WEBHOOK_SECRET is the API
396
+
# server key again: hermes-voice signs its webhook posts with it
397
+
# (hermes-voice.nix).
391
398
environmentFiles = [
392
399
config.clan.core.vars.generators.hermes-env.files."hermes.env".path
393
400
];
···
561
568
MATRIX_ACCESS_TOKEN=$(cat "$in"/hermes-matrix/matrix-access-token)
562
569
LLAMA_API_TOKEN=$(cat "$in"/hermes-llama/llama-api-token)
563
570
API_SERVER_KEY=$(cat "$in"/hermes-api/api_key)
571
+
WEBHOOK_SECRET=$(cat "$in"/hermes-api/api_key)
564
572
CALDAV_PASSWORD=$(cat "$in"/radicale-hermes/password)
565
573
ANTHROPIC_TOKEN=$(cat "$in"/hermes-anthropic/oauth-token)
566
574
EMAIL_PASSWORD=$(cat "$in"/hermes-mail/password)