From e4be9d2079f0dcdcb0f2a0604d0d3ee1a7c0ed8b Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Sat, 19 Sep 2026 12:23:39 -0700
Subject: [PATCH] straylight: headless chromium-cdp user service for hermes
 browser tools

---
 hw/straylight/default.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index f57a0b7..d385337 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -394,6 +394,25 @@ in
       };
     };
 
+    # Headless Chromium exposing a CDP endpoint for Hermes browser tools.
+    # Loopback only; browser.cdp_url in ~/.hermes/config.yaml points at it.
+    # Ungoogled-chromium (already in desktop-packages-light.nix), no ad-block
+    # extension so behavior stays stock; dedicated user-data-dir so this
+    # instance never touches kyle's browsing profile.
+    systemd.user.services.chromium-cdp = {
+      description = "Headless Chromium - CDP endpoint for Hermes browser tools";
+      after = [ "graphical-session.target" ];
+      wantedBy = [ "default.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart =
+          let chromium = pkgs.ungoogled-chromium;
+          in "${chromium}/bin/chromium --headless=new --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --user-data-dir=%h/.cache/chromium-cdp --no-first-run --no-default-browser-check --disable-background-networking";
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+    };
+
     # Open ports: DNS (53), mc-proxy (443/8443/9443), agent (9444), master (9555), open-webui (8080).
     networking.firewall.allowedTCPPorts = [ 53 443 8080 8443 9443 9444 9555 ];
     networking.firewall.allowedUDPPorts = [ 53 ];