diff --git a/configuration.nix b/configuration.nix
index a9701a2..0956726 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -77,6 +77,8 @@
     gnupg
     jq
     pass
+    ripgrep
+    sops
     vim
   ];
 
@@ -102,6 +104,8 @@
   security.sudo.enable = true;
   security.sudo.wheelNeedsPassword = false;
 
+  virtualisation.docker.enable = false;
+
   virtualisation.podman = {
     enable = true;
     dockerCompat = true;
diff --git a/flake.nix b/flake.nix
index dc292a1..ff8533c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,9 +4,10 @@
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
     checker.url = "git+https://codeberg.org/oibot/checker.git";
+    hermes-agent.url = "github:NousResearch/hermes-agent";
   };
 
-  outputs = { self, nixpkgs, sops-nix, checker, ... }:
+  outputs = { self, nixpkgs, sops-nix, checker, hermes-agent, ... }:
     let
       system = "x86_64-linux";
     in {
@@ -27,6 +28,8 @@
           ./modules/nextcloud.nix
           ./modules/totap.nix
           ./modules/checker.nix
+          hermes-agent.nixosModules.default
+          ./modules/hermes-agent.nix
         ];
       };
     };
diff --git a/modules/hermes-agent.nix b/modules/hermes-agent.nix
new file mode 100644
index 0000000..fb8916f
--- /dev/null
+++ b/modules/hermes-agent.nix
@@ -0,0 +1,21 @@
+{ config, ... }:
+
+{
+  sops.secrets."hermes-env" = {};
+
+  services.hermes-agent = {
+    enable = true;
+
+    container = {
+      enable = true;
+      backend = "podman";
+      hostUsers = [ "tobi" ];
+    };
+
+    settings.model.default = "openrouter/anthropic/claude-sonnet-4";
+
+    environmentFiles = [ config.sops.secrets."hermes-env".path ];
+
+    addToSystemPackages = true;
+  };
+}
diff --git a/secrets/tobserver.yaml b/secrets/tobserver.yaml
index b56a745..50f716c 100644
--- a/secrets/tobserver.yaml
+++ b/secrets/tobserver.yaml
@@ -5,6 +5,7 @@ nextcloud:
     admin-pass: ENC[AES256_GCM,data:3xufFHvcm5g5+jn+B4qxRljuWDqDXo1mLu4IlSuax7Cz+3ZoOuNXoCXoiaY=,iv:WaWeu/a45Vuz+HvO7m0dUlCGCexk4IX/ijURmb/7jPU=,tag:ytRjS89AmHiGOhKymViTrg==,type:str]
 checker:
     env: ENC[AES256_GCM,data:TkeIRm8CXS9AiFpOrMD04dX5L/kL1XAYwOavDwtAuaCsg8bhAsmI6L9rdHsVuMnL46EaUwG4mAgn6EK6kfiSzkzgZ63MKrhcwhD3B4ybMMjj1opIWvifKBY2+wJ9bLI1ygZtQToOgti5oWLtcCt7zlDx8RqXKbAYNq9j0SBDhZBiZK/m+YJPPHclxr8cn9TlKfEhW78sZ2fyH8V65vT1Rz8gVDARdaz3G12CO5jLVY0q5ucqXrS8YRsuYczMSI3aUcBwRyf2UESsjDBXqfg7OKsgabGqvEwIK+rlbvo1ylIWFJZGC80FEcn/dAIsxC8ew8vhHwDch+dlbgrdyUxktb0qNBJU+7HdyP9QZ+mfU2Y/FIvRbicZXFIVdTnwls9tt2p+uxJQkLCp7OTyZgDHTECDQBRmg5hAdrvyyJUZAUvbcFVYkK984kSNyELbGsZBz+SGnxbQLuQDYi98T6HbIk448pDaWy43QGiEZERcFfLAVHnhK8wYsw6ta4BJSf95t+Ka9zMDhR/j0v3mkTrvXpprnTTp727jUY8AM+dUfavETfi9VtrD9P73UZWkL/Wy4PezBGGhm/8l6PU8C+6cfKfKswLGkKW8tDzxVKgvAHiWcK3adyW1/wLdTOHP5XMgDxWEGc3EZRJ4hrw1cQRrVqkxHI9q8a2pmQZxi7l1u61V/EXBKQSSHGDX8pg1HFwGSkj4a39llz5auFk3QsWIntDFYIYpQKDXns2pH+A+PbTJEv+UfMvDQnMKMG99njn2r8KKXf88VWs64tCq/uylaslx3f/1CnVwTlr3REI=,iv:5nbRJpjNReztdAaTlHHjh7MH0PAN9eSSEEhE1Z8ynA4=,tag:9gYKrH/0g0bca/Q67LchFA==,type:str]
+hermes-env: ENC[AES256_GCM,data:PYeLEaCuHWykxyet3L9+pq26SSGb+siQBwfZuxwsjiBa/FX/XlYj21hybnzmJPIWWDr/n7dWSzvjDHRzbuhaHphDQBSrLW++3G6ex40M5XlG9OYOI/+A22bwFFpX,iv:xZPvfAU0hpmKVrt9Pb5njG/bU67koxRDjpOMADe6dr4=,tag:lBcxczrm+lqCSQflR6Dt/w==,type:str]
 sops:
     age:
         - recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
@@ -25,7 +26,7 @@ sops:
             cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
             EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-16T15:47:52Z"
-    mac: ENC[AES256_GCM,data:i8h08LjCw0KGB/GsxO0LtCG7rBn/jdfJ2tr6pFJiFs1NSpgh2JyZARItFdmv8Ut7Gov7paCpqEKQ4N76PtjJ2Z9Lu8kfn4qVkEXIoNXjQeJu0FPbia5B7vaC15ZnPDmmmIC330MP08JLqNGihjpKCaaTVSXINDLAm0tOlp8Pqg4=,iv:QE9kc2WapNp5/Gbfvfp/RS3VUNQ16rEb1e6R7xB15Ew=,tag:8XKgA+ksDHE8iuxgINh0EA==,type:str]
+    lastmodified: "2026-05-28T15:18:23Z"
+    mac: ENC[AES256_GCM,data:qeRbvcL2VtklIjjWd36apWzupYdFuUw3WRP3Jw6SAL6y+k+s3EA+i5p+A74sXJ1Ah2hrVJJrLfHIV/cbWQ4UM58QDOSxq41Icjwmn/hS0Ivf1mVY9HFmiYTcwZSB022IXTKPDxAKj03H0ikKfkpKQTiSbmhlYvyewhd9qL953nM=,iv:hF4CuzI2DDYHQd29p1kD+SiOOvtSMdoCacoapo6JT8U=,tag:zdL5VXVf3MvZkg9IDUomEQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.1