fix(m3-hermes): stable Matrix device + DNS pin for homeserver

Root cause chain of recurring Matrix outages (2026-08-16):

1. DNS on m3-hermes resolves exclusively via the Netbird-managed
   resolver. When the Netbird nameserver group is unreachable
   (observed 14:03-15:24), matrix.m3ta.dev fails to resolve.
2. A gateway restart during that window fails the Matrix login, and
   without MATRIX_ACCESS_TOKEN the gateway drops Matrix permanently
   from its reconnect queue ('no bot credential on queued config').
   Recovery happens only on the next restart - with working DNS.
3. The stable-token setup from 2026-08-14 was wiped because it was
   only written to the regenerated .env, not to the agenix secret.

Changes:
- Pin matrix.m3ta.dev to the m3-atlas public IP (TLS termination)
  so the Matrix connection survives Netbird DNS outages.
- Declare MATRIX_DEVICE_ID=HERMES01 in the module environment so the
  device id survives .env regeneration. The matching
  MATRIX_ACCESS_TOKEN must be added to secrets/hermes-env.age
  (separate manual step: agenix edit + re-encrypt).

flake.lock

@@ -56,11 +56,11 @@
         "rev": "75a2ed2533b4d6d8e4a34acd37e83d98d81a5fb0",
         "revCount": 30,
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       },
       "original": {
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       }
     },
     "agents": {
@@ -154,16 +154,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785979955,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.9.0",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -176,16 +176,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785979955,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.9.0",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -223,6 +223,53 @@
         "type": "github"
       }
     },
+    "buzz": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1785934673,
+        "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "type": "github"
+      }
+    },
+    "buzz_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2",
+        "treefmt-nix": "treefmt-nix_3"
+      },
+      "locked": {
+        "lastModified": 1785934673,
+        "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -377,11 +424,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -534,11 +581,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785531816,
+        "lastModified": 1786031233,
-        "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
+        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
+        "rev": "7834e82588860aaf780cec1366524456a70898d7",
         "type": "github"
       },
       "original": {
@@ -621,11 +668,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785566656,
+        "lastModified": 1786014936,
-        "narHash": "sha256-mwIyMLuxUzYDYLk09QL0uKtkNvjQJ0LKOWErMeqNSz4=",
+        "narHash": "sha256-ToQkMfyiH/Af/AMpkJi5zR0fVb1QO1lg9jiyzhLVyjc=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "e222bd1e402f711646012624665af754d00bfa62",
+        "rev": "5028d4667177f2593ceac30f9c8395afaf6a54d9",
         "type": "github"
       },
       "original": {
@@ -651,11 +698,11 @@
         "nur": "nur"
       },
       "locked": {
-        "lastModified": 1785574389,
+        "lastModified": 1786261845,
-        "narHash": "sha256-APU8O7r0pc741pMoy8a0/TWiAZOKw4LFR6JU5MLLPc4=",
+        "narHash": "sha256-377VD83YnIhJtkLbbDDGlp/pfeuP/EqV2Y1TY8ULS64=",
         "ref": "refs/heads/master",
-        "rev": "79264914662e8d7823c2fc8537038b77b3c6b9ab",
+        "rev": "f2cc6b59ef08efc785097571fe2c4b2b7200ef71",
-        "revCount": 103,
+        "revCount": 114,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
       },
@@ -668,6 +715,7 @@
       "inputs": {
         "agents": "agents_2",
         "basecamp": "basecamp",
+        "buzz": "buzz",
         "nixpkgs": [
           "m3ta-home",
           "nixpkgs"
@@ -677,11 +725,11 @@
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1785395945,
+        "lastModified": 1786203962,
-        "narHash": "sha256-/J1bkZi7tb+DxUN3G9bJBCxaJpG4373L+AjxF8SoX9M=",
+        "narHash": "sha256-gvweVFd0Za5AZN6srXAhYK10NYLSfSVG2Xnl/Z73iZU=",
         "ref": "refs/heads/master",
-        "rev": "e3ebb76b1c26ecc3311d65b25fa38d70313b6804",
+        "rev": "6962de7e076ab68e1ead87770982a7d2e676fc02",
-        "revCount": 371,
+        "revCount": 377,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -694,17 +742,18 @@
       "inputs": {
         "agents": "agents_3",
         "basecamp": "basecamp_2",
+        "buzz": "buzz_2",
         "nixpkgs": "nixpkgs_8",
         "nixpkgs-master": "nixpkgs-master_2",
         "opencode": "opencode_2",
         "openspec": "openspec_2"
       },
       "locked": {
-        "lastModified": 1785397255,
+        "lastModified": 1786203962,
-        "narHash": "sha256-eKgjP0pRJbdGLzGhP7QCdcugUr4/0WGhxKwieJNNodk=",
+        "narHash": "sha256-gvweVFd0Za5AZN6srXAhYK10NYLSfSVG2Xnl/Z73iZU=",
         "ref": "refs/heads/master",
-        "rev": "1cbde05767dacdbb5e2c07a4b45fa72f8d9307ed",
+        "rev": "6962de7e076ab68e1ead87770982a7d2e676fc02",
-        "revCount": 372,
+        "revCount": 377,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -865,11 +914,11 @@
     },
     "nixpkgs-master_3": {
       "locked": {
-        "lastModified": 1785574108,
+        "lastModified": 1786029745,
-        "narHash": "sha256-42rCJTtjakPutQcyJ8ru33XiWOY5lwoGAYb/eGlo1ug=",
+        "narHash": "sha256-rZw0LOnTRyyfgpjz70KYSI4cIA5cHY2Mlqey19xQmIc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c5d13b19fd9ad379d7adec5820903448e4ea9443",
+        "rev": "b5a1961b9c902670dc7fb9beced49f2e64ace761",
         "type": "github"
       },
       "original": {
@@ -913,11 +962,11 @@
     },
     "nixpkgs_11": {
       "locked": {
-        "lastModified": 1785483748,
+        "lastModified": 1785747939,
-        "narHash": "sha256-M4HXpLsR7iFTNQfD/q+zK8/QeRYztYVDVIdIgCVGGZ0=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "59ea0b1c043c463e39fcb3cfb9a5c8bcf0777c72",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -961,11 +1010,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1785452004,
+        "lastModified": 1785747939,
-        "narHash": "sha256-k94ksv7XmaLeK5sE1ST/TTdu2aDEO9sfbcgEaNJPTXA=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a5e9f2fd9ef6011c6886d6935f3ef678c81385fa",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -1141,11 +1190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785574468,
+        "lastModified": 1786032888,
-        "narHash": "sha256-vCcf9ERdAwolKzV77eTc/FoClawvNElD3u25I7YErT8=",
+        "narHash": "sha256-6hYYaIo4ODwadrtYLvDKX1ehezDAUJwLuH2g5OkkWt4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "cd37a144ec121ea1f68bb4291944cc9fa9ec08d1",
+        "rev": "366ac747ddcbc2f9243cf0f39ebf33c37c355cba",
         "type": "github"
       },
       "original": {
@@ -1415,6 +1464,51 @@
         "type": "github"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785820796,
+        "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785820796,
+        "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -1497,6 +1591,51 @@
           "nixpkgs"
         ]
       },
+      "locked": {
+        "lastModified": 1785945821,
+        "narHash": "sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "ae7910970dddc408fe6ab1c8e4b277bb21d72dc0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785360170,
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
       "locked": {
         "lastModified": 1785360170,
         "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",

hosts/common/default.nix

@@ -32,7 +32,7 @@
     overlays = [
       # Add overlays your own flake exports (from overlays and pkgs dir):
       #outputs.overlays.additions
-      #outputs.overlays.modifications
+      outputs.overlays.modifications
       outputs.overlays.stable-packages
       # outputs.overlays.locked-packages
       # outputs.overlays.pinned-packages

hosts/m3-hermes/configuration.nix

@@ -13,6 +13,18 @@
   networking.hostName = "m3-hermes";
   networking.hostId = "a1b2c3d4"; # TODO: Generate unique hostId
   networking.networkmanager.enable = true;
+
+  # Matrix homeserver pin: DNS on this host resolves exclusively via the
+  # Netbird-managed resolver (see /etc/resolv.conf → wt0). When the Netbird
+  # nameserver group is unreachable, matrix.m3ta.dev fails to resolve and the
+  # gateway cannot log in (observed 2026-08-16). Pinning the public IP of
+  # m3-atlas (TLS termination for matrix.m3ta.dev) makes the Matrix connection
+  # independent of Netbird DNS health. Update here if the m3-atlas public IP
+  # ever changes.
+  networking.hosts = {
+    "152.53.85.162" = ["matrix.m3ta.dev"];
+  };
+
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
 

hosts/m3-hermes/services/hermes-agent.nix

@@ -104,6 +104,15 @@ in {
       GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
       GIT_INIT_DEFAULT_BRANCH = "master";
 
+      # ── Matrix: stable device (Fix 0, root cause of ghost-device churn) ──
+      # Every gateway restart with password login creates a NEW device on the
+      # homeserver when MATRIX_DEVICE_ID is unset. The matching secret
+      # MATRIX_ACCESS_TOKEN lives in agenix (secrets/hermes-env.age). The token
+      # also keeps Matrix in the gateway's reconnect queue: without it, a
+      # failed startup (e.g. transient DNS outage) permanently drops the
+      # platform ("no bot credential on queued config").
+      MATRIX_DEVICE_ID = "HERMES01";
+
       # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
       # Accessible via Netbird mesh VPN — not exposed to the public internet.
       # Bind to 0.0.0.0 so the Netbird interface can reach it.

overlays/default.nix

@@ -7,22 +7,10 @@
   # This one contains whatever you want to overlay
   # You can change versions, add patches, set compilation flags, anything really.
   # https://nixos.wiki/wiki/Overlays
-  modifications = final: prev: {
+  modifications = final: _prev: {
-    #   n8n = import ./mods/n8n.nix {inherit prev;};
+    # aardvark-dns 2.x has a DNS forwarding bug breaking external name
-
+    # resolution in podman networks — pin to last 1.x from nixpkgs-stable.
-    #   brave = prev.brave.override {
+    aardvark-dns = import ./mods/aardvark-dns.nix {inherit (final) stable;};
-    #     commandLineArgs = "--password-store=gnome-libsecret";
-    #     };
-
-    # hyprpanel = inputs.hyprpanel.packages.${prev.system}.default.overrideAttrs (prev: {
-    #   version = "latest"; # or whatever version you want
-    #   src = final.fetchFromGitHub {
-    #     owner = "Jas-SinghFSU";
-    #     repo = "HyprPanel";
-    #     rev = "master"; # or a specific commit hash
-    #     hash = "sha256-l623fIVhVCU/ylbBmohAtQNbK0YrWlEny0sC/vBJ+dU=";
-    #   };
-    # });
   };
 
   # temp-packages = final: _prev: {
@@ -64,15 +52,36 @@
   # recursion that occurs when accessing final/prev.system while the fixed-point
   # is still being computed.  Exposed via outputs.lib, not outputs.overlays.
   #
-  # Filters out the 16 internal helpers (marked `passthru.hideFromDocs = true`
+  # Use llm-agents' shared-nixpkgs overlay so packages with optional GPU support
+  # (notably qmd) are built against this system's pkgs/config. Using the flake's
+  # pre-built `packages.${system}` set pins them to llm-agents' own nixpkgs,
+  # where allowUnfree is false; qmd.override { cudaSupport = true; } then fails
+  # on CUDA EULA packages during the m3-ares NVIDIA specialisation build.
+  #
+  # Keep the exposed top-level package names aligned with llm-agents' filtered
+  # flake packages, but take the package values from the shared package set.
+  # Filters out internal helpers (marked `passthru.hideFromDocs = true`
   # upstream) that would otherwise clobber nixpkgs attributes. Most critically
   # this excludes `buildNpmPackage` — llm-agents' buildNpmPackage is a guarded
   # re-export whose `__functor`/`override` interaction with makeOverridable
   # breaks any package (e.g. nixpkgs' webcord) that calls
   # `buildNpmPackage.override { nodejs = ...; }`. See numtide/llm-agents.nix
   # commit 40490259 and the wrapper at packages/buildNpmPackage/package.nix.
-  mkLlmAgentsOverlay = system: _final: _prev:
+  mkLlmAgentsOverlay = system: final: prev: let
-    builtins.removeAttrs (inputs.llm-agents.packages.${system} or {}) [
+    sharedPackages = (inputs.llm-agents.overlays.shared-nixpkgs final prev).llm-agents or {};
+    exposedPackageNames =
+      builtins.filter
+      (name: inputs.nixpkgs.lib.hasAttrByPath [name] sharedPackages)
+      (builtins.attrNames (inputs.llm-agents.packages.${system} or {}));
+    exposedPackages =
+      builtins.listToAttrs
+      (map (name: {
+          inherit name;
+          value = sharedPackages.${name};
+        })
+        exposedPackageNames);
+  in
+    builtins.removeAttrs exposedPackages [
       # Internal helpers from packages/* marked hideFromDocs upstream:
       "antigravity"
       "auto-claude"

overlays/mods/aardvark-dns.nix

@@ -0,0 +1,12 @@
+# aardvark-dns pinned to the 1.x series.
+#
+# aardvark-dns 2.x has a DNS forwarding bug that breaks resolution of
+# external hostnames in podman networks.  1.17.1 is the last 1.x release
+# and is taken from nixpkgs-stable (nixos-26.05), which ships it together
+# with netavark 1.17.2 — the same netavark version as our unstable input,
+# so this is the exact upstream-tested combination.
+#
+# No further wiring needed: the nixpkgs podman package pulls aardvark-dns
+# in via callPackage and symlinks it into libexec/podman (helpersBin), so
+# overriding the top-level attribute propagates to podman automatically.
+{stable}: stable.aardvark-dns