feat: initial nix package and NixOS module for hermes-agent v0.2.0

- buildPythonApplication with Python 3.12
- All extras included (messaging, cron, tts, voice, mcp, honcho, acp)
- Custom PyPI packages: fal-client, honcho-ai, agent-client-protocol
- NixOS module with systemd service for gateway mode
- Runtime deps wrapped: nodejs 22, ripgrep, ffmpeg, git
- Flake-based with overlay support

module.nix

@@ -0,0 +1,125 @@
+self:
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.hermes-agent;
+  hermes-agent = self.packages.${pkgs.system}.hermes-agent;
+in
+{
+  options.services.hermes-agent = {
+    enable = lib.mkEnableOption "Hermes Agent gateway service";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = hermes-agent;
+      description = "The hermes-agent package to use.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "hermes";
+      description = "User under which Hermes Agent runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "hermes";
+      description = "Group under which Hermes Agent runs.";
+    };
+
+    homeDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/hermes";
+      description = "Home directory for Hermes Agent state.";
+    };
+
+    workDir = lib.mkOption {
+      type = lib.types.path;
+      default = "${cfg.homeDir}/workspace";
+      defaultText = lib.literalExpression ''"''${cfg.homeDir}/workspace"'';
+      description = "Working directory for Hermes Agent.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to an environment file containing secrets (API keys, tokens).
+        This file should contain lines like:
+          ANTHROPIC_API_KEY=sk-...
+          TELEGRAM_TOKEN=...
+          OPENROUTER_API_KEY=...
+      '';
+    };
+
+    extraEnvironment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = "Extra environment variables for the Hermes Agent service.";
+      example = lib.literalExpression ''
+        {
+          HERMES_DEFAULT_MODEL = "anthropic/claude-sonnet-4-20250514";
+        }
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra command-line arguments to pass to hermes gateway.";
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = "Extra packages to make available on PATH.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      home = cfg.homeDir;
+      createHome = true;
+      description = "Hermes Agent service user";
+    };
+
+    users.groups.${cfg.group} = { };
+
+    systemd.services.hermes-agent = {
+      description = "Hermes Agent Gateway";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        HOME = cfg.homeDir;
+        HERMES_HOME = "${cfg.homeDir}/.hermes";
+      } // cfg.extraEnvironment;
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.workDir;
+        ExecStart = lib.concatStringsSep " " ([
+          "${cfg.package}/bin/hermes"
+          "gateway"
+        ] ++ cfg.extraArgs);
+        Restart = "on-failure";
+        RestartSec = 5;
+        # Hardening
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = false;
+        ReadWritePaths = [ cfg.homeDir ];
+        PrivateTmp = true;
+      } // lib.optionalAttrs (cfg.environmentFile != null) {
+        EnvironmentFile = cfg.environmentFile;
+      };
+
+      path = [ cfg.package ] ++ cfg.extraPackages;
+    };
+  };
+}