Drop the custom mkLlmAgentsOverlay factory (172 top-level attrs +
17-entry blocklist guarding against nixpkgs clobbering — the source of
the webcord buildNpmPackage and fetchPnpmDeps stack overflows).
Apply inputs.llm-agents.overlays.shared-nixpkgs directly instead. It
exposes everything under the pkgs.llm-agents.* namespace and clobbers
nothing, so the blocklist becomes unnecessary. Packages stay built
against this system's nixpkgs (allowUnfree), which qmd.override
cudaSupport in the m3-ares NVIDIA specialisation requires.
Consumers switched to namespaced refs:
- hosts/m3-hermes/services/hermes-agent.nix: herdr, opencode, qmd
- m3ta-home agents.nix (input bumped): agent-browser, beads, herdr,
qmd, openspec — unqualified refs would now silently resolve to
outdated nixpkgs attrs (opencode 0.3.x) or vanish.
openspec pass-through dropped from m3ta-nixpkgs (input bumped):
llm-agents is the single source of truth now.
Note: flake.nix/lock carry the pre-existing local path inputs for
m3ta-home and m3ta-nixpkgs (dev state, gitea URLs kept as comments).
Verified: drvPath evals for m3-hermes, m3-atlas, and the m3-ares
NVIDIA specialisation (qmd + CUDA EULA) all pass; statix/deadnix clean.
Propagates the appimage extract fix, the buzz 0.5.20 bump (fixed
rust-overlay), and the libreoffice-stable switch — clears all fixable
evaluation warnings on m3-kratos.
The exported M3_SHELL_TO_NU marker leaked into programs started from
nu (zellij, zed, herdr), keeping their spawned terminals in bash.
Decide via /proc/$PPID/comm instead: interactive bash whose parent is
neither nu nor bash execs into nu; a deliberate 'bash' started from
nu/bash stays bash. Non-interactive bash (ssh command exec, Mosh app
bootstrap, see 765ae15) is still covered by the $- == *i* check.
Default login shell is now bash for all hosts; interactive bash
sessions exec into nushell via /etc/bashrc. A ~/.bashrc sourcing
/etc/bashrc covers non-login interactive shells (terminal emulators).
Non-interactive SSH exec (mosh app bootstrap, scripts) keeps POSIX
shell semantics. Reverts the kratos-host-specific overlay from
765ae15.
The old Android Mosh app discovers mosh-server via POSIX shell idioms
(command -v / type) through the user's login shell. Nushell has no
command/type builtins and which prints a table, so the app reported
'mosh-server Not Found' on kratos (user shell: nu) while working on
hermes (app logs in as bash user).
Fix: use bash as login shell on kratos and exec into nushell for
interactive login sessions via programs.bash.interactiveShellInit.
Non-interactive SSH exec (app bootstrap, Termux mosh) stays in bash
where POSIX semantics work.
Also fixes the stale nh flake path (p/nixos -> p/NIX).
aardvark-dns 2.0.0 has a DNS forwarding bug breaking external name
resolution in podman networks. Pin to 1.17.1 (last 1.x) from
nixpkgs-stable; the nixpkgs podman wrapper picks it up via helpersBin
automatically.
Root cause: The complex concatStringsSep command with power commands
(--power-shutdown, --power-reboot) and multiple --remember flags was
causing tuigreet to display its usage/flags instead of the login UI.
The quoting in the systemd binary paths may have been problematic.
Changes:
- Use lib.getExe instead of manual bin path for tuigreet
- Use simple 'Hyprland' command (found via PATH) instead of
the full start-hyprland path which may have issues
- Remove unverified options: --remember-session, --remember-user-session,
--user-menu, --user-menu-min-uid, --power-shutdown, --power-reboot
- Keep only verified options: --time, --remember, --asterisks, --cmd
- Update tmpfiles comment to reflect actual requirement
This provides a minimal, stable login that works reliably.
User can reboot to test.
Access control is handled at DNS level — dash.m3ta.dev resolves to
Netbird IP (100.81.142.56) which is unreachable from the public internet.
No need for IP whitelist middleware.
- New hermes-dashboard.service: runs 'hermes dashboard' on 0.0.0.0:9119
- Firewall restricts port 9119 to Netbird mesh VPN range (100.64.0.0/16)
- Runs as hermes user with NoNewPrivileges + ProtectSystem hardening
- Depends on hermes-agent.service (starts after gateway)
- Added placeholder hermes-api-server-key.age (needs real encryption on host)
All home-manager configuration is now centralized in the m3ta-home repo:
- profiles/base/ ← shell, CLI tools, secrets
- profiles/contexts/ ← desktop, server
- profiles/sets/ ← coding, gaming, media
- users/ ← identities, preferences
Per-host overrides (monitors, XDG/MIME) remain in hosts/<name>/home.nix.
Central user integration via hosts/common/users/m3tam3re.nix.
- Enable delegation.orchestrator_enabled with max_spawn_depth=2
- Switch TTS from ElevenLabs (paid) to Edge TTS (free)
- Voice: de-DE-SeraphinaMultilingualNeural — friendly, multilingual German female
- No API key required
Add pkgs.uv to systemd.services.hermes-agent.path so that CronJobs
and terminal sessions can execute PEP 723 scripts via 'uv run'
(e.g. garmin-daily.py for Garmin Connect health data).
Also adds uv to environment.systemPackages for general availability.
m3ta-chiron