{ config, ... }:

{
  sops.secrets."hermes-env" = {};

  sops.secrets."hermes/auth.json" = {
    owner = "hermes";
    group = "hermes";
    mode = "0400";
  };

  services.hermes-agent = {
    enable = true;

    container = {
      enable = true;
      backend = "podman";
      hostUsers = [ "tobi" ];
    };

    settings.model = {
      provider = "openai-codex";
      default = "gpt-5.5";
    };

    authFile = config.sops.secrets."hermes/auth.json".path;
    authFileForceOverwrite = true;

    environmentFiles = [ config.sops.secrets."hermes-env".path ];

    extraDependencyGroups = [ "messaging"];

    addToSystemPackages = true;
  };
}