16 lines
1.1 KiB
Markdown
16 lines
1.1 KiB
Markdown
# agent
|
|
|
|
NixOS 26.05 VM at `s0.sermc.net` (SSH externally on port 6522), managed by `.#agent`.
|
|
This host intentionally does not import the shared `server` profile: that profile enables Docker and disables wheel sudo prompts, whereas the existing agent VM does neither. SSH replies bypass Mihomo TUN via `ssh-direct-route`.
|
|
|
|
Apply on the VM from a checkout with its locked inputs:
|
|
|
|
```sh
|
|
sudo nixos-rebuild build --flake .#agent
|
|
sudo nixos-rebuild switch --flake .#agent
|
|
```
|
|
|
|
`/etc/mihomo-config.yaml` is a root-owned mode-0600 subscription with credentials. It stays outside Git and must be provisioned separately before enabling Mihomo. Never place the subscription, API keys, or SSH secrets in the Nix store or this public repository.
|
|
|
|
Hermes Agent and OMP are pinned to the exact upstream commits from which the previous local archives were extracted. Their `flake.nix` hashes matched the old local trees before cutover; the full packages must still build and pass the CLI smoke check after re-locking. The server needs the pinned sources and binary caches available at build time.
|