piabrota · hermes

config.yaml

from hermes.nix

The keys nix-os owns. On every activation they are merged into /var/lib/hermes/.hermes/config.yaml, which also keeps the keys Hermes writes itself.

/var/lib/hermes/.hermes/config.yaml

agent:
  max_turns: 60
  restart_after_turn_timeout: 600
auxiliary:
  goal_judge:
    model: claude-haiku-5-5
    provider: anthropic
  skills_hub:
    model: claude-haiku-5-5
    provider: anthropic
  title_generation:
    model: claude-haiku-5-5
    provider: anthropic
compression:
  threshold: 0.400000
cron:
  wrap_response: false
dashboard:
  theme: piabrota
delegation:
  fallback_providers: []
  max_iterations: 50
  max_spawn_depth: 1
  model: claude-haiku-5-5
  provider: anthropic
display:
  skin: piabrota
fallback_providers: []
goals:
  max_turns: 6
mcp:
  auto_reload_on_config_change: false
mcp_servers:
  context7:
    enabled: true
    url: https://mcp.context7.com/mcp
  deepwiki:
    enabled: true
    url: https://mcp.deepwiki.com/mcp
model:
  default: claude-sonnet-5-5
  provider: anthropic
model_catalog:
  enabled: false
plugins:
  enabled:
    - custom-dangerous-patterns
    - tripwire
    - public-holidays
    - memory-rewind
    - hermes-guide
    - hermes-plugin-guard
    - superpowers
    - approval-ledger
    - aux-ledger
    - error-ledger
    - gh-ref
    - github-copilot
    - inbox
    - progress-squash
    - stop-ledger
    - telegram-business
    - wiki-ref
    - workflow-record
    - pirsig-notes
    - pirsig-videos
prompt_caching:
  cache_ttl: auto
security:
  allow_lazy_installs: false
sessions:
  auto_prune: true
  retention_days: 45
  vacuum_after_prune: true
skills:
  external_dirs:
    - "/nix/store/…-hermes-optional-skills"
    - "/nix/store/…-hermes-owner-skills"
    - "/nix/store/…-skills"
telegram:
  reactions: true
telemetry:
  shared_metrics:
    enabled: false
terminal:
  cwd: /var/lib/hermes/workspace
timezone: America/Sao_Paulo
tool_loop_guardrails:
  hard_stop_enabled: true
updates:
  check: false

The unit

how nix-os runs it

The package, its limits, and what is installed beside the config. A merge to main deploys it.

hermes-agent.service

cpu_weight: 50
environment:
  HERMES_CUSTOM_PATTERNS_PATH: "/nix/store/…-dangerous-patterns.yaml"
  HERMES_TELEGRAM_DISABLE_FALLBACK_IPS: "true"
extras:
  - anthropic
  - messaging
  - mcp
  - ddgs
files:
  - SOUL.md
  - dashboard-themes/piabrota.yaml
  - feeds/feeds.toml
  - scripts/export-skills.sh
  - scripts/feed-build.py
  - scripts/kvm4-health-alert.sh
  - scripts/refresh-grid.sh
  - skins/piabrota.yaml
  - AGENTS.md
memory_max: 8G
package: hermes-agent 0.23.0
packages:
  - rig
  - gh 2.103.3
  - jq 1.8.2
  - ast-grep 0.42.1
  - yt-dlp 2026.10.26
  - manim 0.20.1
  - omp
  - kvm4-health
  - omp-stream
  - omp-run
plugins:
  - custom-dangerous-patterns
  - tripwire
  - public-holidays
  - memory-rewind
  - hermes-guide
  - hermes-plugin-guard
  - superpowers
  - approval-ledger
  - aux-ledger
  - error-ledger
  - gh-ref
  - github-copilot
  - inbox
  - progress-squash
  - stop-ledger
  - telegram-business
  - wiki-ref
  - workflow-record
  - pirsig-notes
  - pirsig-videos
state: /var/lib/hermes
unit: hermes-agent.service
upstream:
  commit: 2bd378ed1b8d6bf2192cb26e0a55ff3091e6bd19
  date: "2026-11-05"
  repository: github.com/NousResearch/hermes-agent
  version: v0.23.0
working_directory: /var/lib/hermes/workspace

The upstream commit the flake pins ↗

The upstream release the flake pins ↗

Not shown

secrets

The Claude token, the chat platforms' tokens and the allowed users live only on the box, in a root-only file that Nix never reads. A key that names a token, a key, a secret, a password or allowed users is dropped before the page is built, and the build stops if one gets through.