From ebc001c1985c5efa4b9b6f11fe26f5e38753a682 Mon Sep 17 00:00:00 2001
From: Hermes Agent <agent@hermes.nousresearch.com>
Date: Wed, 15 Jul 2026 16:13:17 +0200
Subject: [PATCH] refactor: ports option + add git, curl, jq to image packages

- Replace single  option with  list in hermes module
- Caddy uses the first port from the list for the dashboard proxy
- Expose all listed ports in the OCI image
- Add port 8644 alongside 9999 in flake.nix
- Add git, curl, jq to image packages for better tooling inside the VM
---
 flake.nix                          |  4 ++++
 modules/exedev/services/hermes.nix | 14 +++++++-------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index d8c544d..06b0529 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,6 +58,9 @@
                   procps
                   tzdata
                   util-linux
+                  curl
+                  git
+                  jq
                   # browser tool: system chromium + the agent-browser CLI.
                   chromium
                   (import ./packages/agent-browser { inherit pkgs; })
@@ -84,6 +87,7 @@
                 };
                 # agent-browser uses this instead of downloading its own chromium.
                 environment.AGENT_BROWSER_EXECUTABLE_PATH = "/bin/chromium";
+                ports = [ 9999 8644 ];
                 # exe.dev LLM integration (llm.int.exe.xyz, attached auto:all).
                 settings =
                   let
diff --git a/modules/exedev/services/hermes.nix b/modules/exedev/services/hermes.nix
index e27c21c..8b9c21a 100644
--- a/modules/exedev/services/hermes.nix
+++ b/modules/exedev/services/hermes.nix
@@ -45,13 +45,13 @@ in
       default = "hermes";
       description = "Account to run Hermes as; declared by this module.";
     };
-    port = mkOption {
-      type = types.port;
-      default = 9999;
-      description = "Public port caddy serves the dashboard on.";
+    ports = mkOption {
+      type = types.listOf types.port;
+      default = [ 9999 ];
+      description = "Public ports to expose; the first is used for the dashboard proxy.";
     };
     internalPort = mkOption {
-      type = types.port;
+      type = types.listOf types.port;
       default = 9119;
       description = "Loopback port hermes itself binds.";
     };
@@ -117,7 +117,7 @@ in
         exec /command/s6-setuidgid ${cfg.user} \
           env HOME=${user.home} XDG_DATA_HOME=/run/caddy XDG_CONFIG_HOME=/run/caddy \
           ${pkgs.caddy}/bin/caddy reverse-proxy \
-            --from http://:${toString cfg.port} \
+            --from http://:${toString (builtins.head cfg.ports)} \
             --to 127.0.0.1:${toString cfg.internalPort} \
             --change-host-header \
             --header-up "Origin: http://127.0.0.1:${toString cfg.internalPort}"
@@ -136,7 +136,7 @@ in
     };
 
     image.packages = [ cfg.package ];
-    image.exposedPorts.tcp = [ cfg.port ];
+    image.exposedPorts.tcp = cfg.ports;
     image.labels."exe.dev/install-shelley" = "true";
   };
 }