From 40ed4c101f606164c6564c2d8a467c0b0f6d7967 Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Mon, 11 May 2026 18:26:03 +0200
Subject: [PATCH] fix: hermes-remote uses hermes user with ~/.ssh/hermes
 identity

---
 profiles/base/cli-tools/hermes-remote.nix | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/profiles/base/cli-tools/hermes-remote.nix b/profiles/base/cli-tools/hermes-remote.nix
index 01bb3a4..a7ad8b7 100644
--- a/profiles/base/cli-tools/hermes-remote.nix
+++ b/profiles/base/cli-tools/hermes-remote.nix
@@ -15,7 +15,19 @@ in {
     host = mkOption {
       type = types.str;
       default = "m3-hermes";
-      description = "SSH hostname (must match a matchBlocks entry).";
+      description = "SSH hostname (resolved via ~/.ssh/config matchBlocks).";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "hermes";
+      description = "Remote SSH user.";
+    };
+
+    identityFile = mkOption {
+      type = types.str;
+      default = "~/.ssh/hermes";
+      description = "SSH private key for the hermes user.";
     };
 
     session = mkOption {
@@ -28,9 +40,10 @@ in {
   config = mkIf cfg.enable {
     home.packages = [
       (pkgs.writeShellScriptBin "hermes-remote" ''
-        # hermes-remote — SSH into m3-hermes and attach/create a Zellij session with hermes CLI.
-        # Uses -t for PTY allocation (required by both Zellij and Hermes).
-        exec ssh -t ${cfg.host} "zellij attach -c ${cfg.session} || zellij -s ${cfg.session}"
+        # hermes-remote — SSH into m3-hermes as the hermes user and
+        # attach/create a Zellij session with the Hermes CLI.
+        exec ssh -t -i ${cfg.identityFile} ${cfg.user}@${cfg.host} \
+          "zellij attach -c ${cfg.session} || zellij -s ${cfg.session}"
       '')
     ];
   };