Root cause chain of recurring Matrix outages (2026-08-16):
1. DNS on m3-hermes resolves exclusively via the Netbird-managed
resolver. When the Netbird nameserver group is unreachable
(observed 14:03-15:24), matrix.m3ta.dev fails to resolve.
2. A gateway restart during that window fails the Matrix login, and
without MATRIX_ACCESS_TOKEN the gateway drops Matrix permanently
from its reconnect queue ('no bot credential on queued config').
Recovery happens only on the next restart - with working DNS.
3. The stable-token setup from 2026-08-14 was wiped because it was
only written to the regenerated .env, not to the agenix secret.
Changes:
- Pin matrix.m3ta.dev to the m3-atlas public IP (TLS termination)
so the Matrix connection survives Netbird DNS outages.
- Declare MATRIX_DEVICE_ID=HERMES01 in the module environment so the
device id survives .env regeneration. The matching
MATRIX_ACCESS_TOKEN must be added to secrets/hermes-env.age
(separate manual step: agenix edit + re-encrypt).
- New hermes-dashboard.service: runs 'hermes dashboard' on 0.0.0.0:9119
- Firewall restricts port 9119 to Netbird mesh VPN range (100.64.0.0/16)
- Runs as hermes user with NoNewPrivileges + ProtectSystem hardening
- Depends on hermes-agent.service (starts after gateway)
- Added placeholder hermes-api-server-key.age (needs real encryption on host)
- Enable delegation.orchestrator_enabled with max_spawn_depth=2
- Switch TTS from ElevenLabs (paid) to Edge TTS (free)
- Voice: de-DE-SeraphinaMultilingualNeural — friendly, multilingual German female
- No API key required
Add pkgs.uv to systemd.services.hermes-agent.path so that CronJobs
and terminal sessions can execute PEP 723 scripts via 'uv run'
(e.g. garmin-daily.py for Garmin Connect health data).
Also adds uv to environment.systemPackages for general availability.
- Fix hardcoded user path in webapps.nix (use homeDirectory)
- Normalize wallpapers option to use .enable suffix
- Remove duplicate FZF keybind declaration
- Update comments to match actual implementation
matrix-nio is installed in the container's writable venv layer
(~/.venv) but the hermes process uses the read-only Nix store Python.
This adds PYTHONPATH and LD_LIBRARY_PATH as container-level env vars
so matrix-nio + libolm (e2e encryption) are importable.
m3ta-chiron
m3tam3re
m3tam3re