feat(nixos): integrate agent VM into host configurations

2026-10-22 10:20:30 +08:00
parent d71fab81d5
commit 5c2e25b989
14 changed files with 826 additions and 28 deletions
@@ -0,0 +1,15 @@
+# agent
+
+NixOS 26.05 VM at `s0.sermc.net` (SSH externally on port 6522), managed by `.#agent`.
+This host intentionally does not import the shared `server` profile: that profile enables Docker and disables wheel sudo prompts, whereas the existing agent VM does neither. SSH replies bypass Mihomo TUN via `ssh-direct-route`.
+
+Apply on the VM from a checkout with its locked inputs:
+
+```sh
+sudo nixos-rebuild build --flake .#agent
+sudo nixos-rebuild switch --flake .#agent
+```
+
+`/etc/mihomo-config.yaml` is a root-owned mode-0600 subscription with credentials. It stays outside Git and must be provisioned separately before enabling Mihomo. Never place the subscription, API keys, or SSH secrets in the Nix store or this public repository.
+
+Hermes Agent and OMP are pinned to the exact upstream commits from which the previous local archives were extracted. Their `flake.nix` hashes matched the old local trees before cutover; the full packages must still build and pass the CLI smoke check after re-locking. The server needs the pinned sources and binary caches available at build time.
@@ -0,0 +1,33 @@
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    useOSProber = true;
+  };
+
+  networking.networkmanager.enable = true;
+
+  time.timeZone = "Asia/Shanghai";
+  i18n.defaultLocale = "zh_CN.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "zh_CN.UTF-8";
+    LC_IDENTIFICATION = "zh_CN.UTF-8";
+    LC_MEASUREMENT = "zh_CN.UTF-8";
+    LC_MONETARY = "zh_CN.UTF-8";
+    LC_NAME = "zh_CN.UTF-8";
+    LC_NUMERIC = "zh_CN.UTF-8";
+    LC_PAPER = "zh_CN.UTF-8";
+    LC_TELEPHONE = "zh_CN.UTF-8";
+    LC_TIME = "zh_CN.UTF-8";
+  };
+  services.xserver.xkb.layout = "cn";
+
+  users.users.luochen570 = {
+    isNormalUser = true;
+    description = "luochen570";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+  };
+}
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+  ];
+}
@@ -0,0 +1,27 @@
+# Generated by nixos-generate-config for this VM; keep device UUID intact.
+{
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.kernelModules = [ "kvm-amd" ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/182efe7c-8bb0-4229-8815-1c58bf67dde4";
+    fsType = "ext4";
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
@@ -0,0 +1,54 @@
+{
+  pkgs,
+  inputs,
+  system,
+  ...
+}:
+
+{
+  imports = [ inputs.agent-nix4nvchad.homeManagerModules.default ];
+
+  home.username = "luochen570";
+  home.homeDirectory = "/home/luochen570";
+  programs.nvchad.enable = true;
+
+  home.packages = with pkgs; [
+    inputs.hermes-agent.packages.${system}.default
+    inputs.omp.packages.${system}.default
+    inputs.nixpkgs-unstable.legacyPackages.${system}.cc-switch-cli
+    inputs.herdr-nix.packages.${system}.default
+    codex
+    opencode
+    pi-coding-agent
+    zeroclaw
+    htop
+    fastfetch
+    hyfetch # Provides the maintained neofetch command.
+    zsh
+    eza
+    uv
+    bat
+    yazi
+    ncdu
+    duf
+    git
+    gh
+    podman
+    vim
+    tailscale
+    docker-client
+    curl
+    wget
+    fzf
+    unzip
+    zip
+    p7zip
+    unrar
+    gzip
+    bzip2
+    xz
+    zstd
+    libarchive
+    gnutar
+  ];
+}