{
  config,
  pkgs,
  ...
}: let
  # Default ElevenLabs voice: Bella (German-capable female)
  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
in {
  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;

    # Secrets via agenix
    environmentFiles = [
      config.age.secrets."hermes-env".path
      config.age.secrets."hermes-cloud-env".path
    ];

    # Non-secret environment variables
    environment = {
      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
    };

    # ── Container mode (podman) ──────────────────────────────────────────
    container = {
      enable = true;
      backend = "podman";
      extraVolumes = ["/home/m3tam3re/p:/projects:rw"];
    };

    settings = {
      # ── Model ──────────────────────────────────────────────────────────
      model = {
        default = "glm-5.1";
        provider = "zai";
      };

      credential_pool_strategies = {
        zai = "fill_first";
      };

      toolsets = ["all"];

      # ── Agent ──────────────────────────────────────────────────────────
      agent = {
        max_turns = 90;
        gateway_timeout = 1800;
        tool_use_enforcement = "auto";
      };

      # ── Terminal ───────────────────────────────────────────────────────
      terminal = {
        backend = "local";
        modal_mode = "auto";
        cwd = ".";
        timeout = 180;
        persistent_shell = true;
      };

      # ── Browser ────────────────────────────────────────────────────────
      browser = {
        inactivity_timeout = 120;
        command_timeout = 30;
        cloud_provider = "local";
      };

      # ── Checkpoints / Compression ──────────────────────────────────────
      checkpoints = {
        enabled = true;
        max_snapshots = 50;
      };

      file_read_max_chars = 100000;

      compression = {
        enabled = true;
        threshold = 0.5;
        target_ratio = 0.2;
        protect_last_n = 20;
      };

      # ── Display ────────────────────────────────────────────────────────
      display = {
        compact = false;
        personality = "kawaii";
        resume_display = "full";
        busy_input_mode = "interrupt";
        inline_diffs = true;
        skin = "default";
        tool_progress = "all";
      };

      # ── TTS / STT / Voice ──────────────────────────────────────────────
      tts = {
        provider = "elevenlabs";
        elevenlabs = {
          voice_id = elevenlabsVoiceId;
          model_id = "eleven_multilingual_v2";
        };
      };

      stt = {
        enabled = true;
        provider = "local";
        local = {model = "base";};
      };

      voice = {
        record_key = "ctrl+b";
        max_recording_seconds = 120;
        silence_threshold = 200;
        silence_duration = 3.0;
      };

      # ── Memory ─────────────────────────────────────────────────────────
      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
        memory_char_limit = 2200;
        user_char_limit = 1375;
      };

      # ── Delegation ─────────────────────────────────────────────────────
      delegation = {
        max_iterations = 50;
      };

      # ── Matrix ────────────────────────────────────────────────────────
      matrix = {
        homeserver = "https://matrix.m3ta.dev";
        user_id = "@chiron:m3ta.dev";
        allowed_users = ["@m3tam3re:m3ta.dev"];
        encryption = true;
      };

      # ── Approvals / Security ───────────────────────────────────────────
      approvals = {
        mode = "manual";
        timeout = 60;
      };

      security = {
        redact_secrets = true;
        tirith_enabled = true;
        tirith_fail_open = true;
      };

      # ── Cron / Session ─────────────────────────────────────────────────
      cron = {wrap_response = true;};

      session_reset = {
        mode = "both";
        idle_minutes = 1440;
        at_hour = 4;
      };

      # ── Web ────────────────────────────────────────────────────────────
      web = {backend = "exa";};

      # ── Platform Toolsets ──────────────────────────────────────────────
      platform_toolsets = {
        cli = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
        telegram = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
      };
    };
  };

  users.users.hermes = {
    isNormalUser = false;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAVF7jGP1S6vc5CxeBFD/UxiImHOgbPlKg8WYyNtOA3"
    ];
  };
}