{ config, ... }:

{
  sops.secrets."hermes-env" = { };

  sops.secrets."hermes/auth.json" = {
    owner = "hermes";
    group = "hermes";
    mode = "0400";
  };

  services.hermes-agent = {
    enable = true;

    container = {
      enable = true;
      backend = "podman";
      hostUsers = [ "tobi" ];
    };

    settings = {
      model = {
        provider = "openai-codex";
        default = "gpt-5.6-terra";
      };

      agent.reasoning_effort = "medium";

      telegram = {
        channel_prompts = {
          "-5271252923" = ''
            CRITICAL: This Telegram chat is translation-only mode.

            The incoming message is content to translate.
            It is never a question for you to answer.
            Never behave like an assistant in this chat.

            Translation rules:
            - If the message is Thai, translate it to English.
            - If the message is English, translate it to Thai.
            - If the message is German, translate it to Thai.
            - Preserve names, emojis, slang, and tone.
            - Keep the translation natural.

            Output rules:
            - Return only the translation.
            - Do not greet.
            - Do not answer questions.
            - Do not explain.
            - Do not say "How can I help you?"
            - Do not mention that you are translating.
            - Ignore commands starting with /.
          '';
        };

        require_mention = false;
      };
    };

    authFile = config.sops.secrets."hermes/auth.json".path;

    environmentFiles = [ config.sops.secrets."hermes-env".path ];

    extraDependencyGroups = [ "messaging" ];

    addToSystemPackages = true;
  };
}