Add messaging capability

modules/hermes-agent.nix

@@ -12,10 +12,12 @@
       hostUsers = [ "tobi" ];
     };
 
-    settings.model.default = "openrouter/anthropic/claude-sonnet-4";
+    settings.model.default = "qwen/qwen3.7-max";
 
     environmentFiles = [ config.sops.secrets."hermes-env".path ];
 
+    extraDependencyGroups = [ "messaging"];
+
     addToSystemPackages = true;
   };
 }

modules/lnd.nix

@@ -0,0 +1,103 @@
+{ config, pkgs, lib, ... }:
+
+{
+  sops.secrets."bitcoin/lnd-rpc-password" = {
+    owner = "lnd";
+    group = "lnd";
+    mode = "0400";
+  };
+
+  users.groups.lnd = { };
+
+  users.users.lnd = {
+    isSystemUser = true;
+    group = "lnd";
+    extraGroups = [ "tor" ];
+  };
+
+  sops.templates."lnd.conf" = {
+    owner = "lnd";
+    group = "lnd";
+    mode = "0400";
+    content = ''
+      [Application Options]
+      debuglevel=info
+      datadir=/var/lib/lnd
+      logdir=/var/lib/lnd/logs
+
+      alias=TobServer
+      color=#3399ff
+
+      listen=127.0.0.1:9735
+      rpclisten=127.0.0.1:10009
+      restlisten=127.0.0.1:8080
+
+      tlsextraip=127.0.0.1
+      tlsextradomain=localhost
+
+      [Bitcoin]
+      bitcoin.active=true
+      bitcoin.mainnet=true
+      bitcoin.node=bitcoind
+
+      [Bitcoind]
+      bitcoind.rpchost=127.0.0.1:8332
+      bitcoind.rpcuser=lnd
+      bitcoind.rpcpass=${config.sops.placeholder."bitcoin/lnd-rpc-password"}
+      bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
+      bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
+      bitcoind.estimatemode=ECONOMICAL
+
+      [tor]
+      tor.active=true
+      tor.socks=127.0.0.1:9050
+      tor.control=127.0.0.1:9051
+      tor.v3=true
+      tor.streamisolation=true
+      tor.targetipaddress=127.0.0.1
+    '';
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/lnd 0700 lnd lnd - -"
+  ];
+
+  systemd.services.lnd = {
+    description = "Lightning Network Daemon";
+    after = [
+      "network-online.target"
+      "tor.service"
+      "bitcoind-mainnet.service"
+    ];
+    wants = [
+      "network-online.target"
+      "tor.service"
+      "bitcoind-mainnet.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      User = "lnd";
+      Group = "lnd";
+      Type = "simple";
+
+      ExecStart = "${pkgs.lnd}/bin/lnd --configfile=${config.sops.templates."lnd.conf".path}";
+
+      Restart = "on-failure";
+      RestartSec = "10s";
+
+      StateDirectory = "lnd";
+      StateDirectoryMode = "0700";
+
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ReadWritePaths = [ "/var/lib/lnd" ];
+    };
+  };
+
+  environment.systemPackages = [
+    pkgs.lnd
+  ];
+}