feat: add WireGuard Waybar custom module

- Added scripts/wireguard-status.sh — JSON output with lock/unlock icons,
  human-readable TX/RX stats, tooltip with peer/endpoint/IP details
- Added custom/wireguard module to Waybar modules.json (10s interval, JSON
  return type, click left/right for up/down)
- Added custom/wireguard to modules-right bar config
- Added CSS for #custom-wireguard (connected/disconnected classes)
- Added openresolv install and Waybar refresh instructions to README.org

Makefile

@@ -1,5 +1,5 @@
 # Define list of directories you want to stow
-CONFIG_DIRS := btop doom hypr kitty nvim rclone starship tmux wallpapers waybar wireplumber wofi yazi zsh
+CONFIG_DIRS := btop doom hypr kitty local nvim rclone starship tmux wallpapers waybar wireplumber wofi yazi zsh
 
 all: stow_all
 	wal -i ~/.config/wallpapers/green_yellow_forest.jpg -o ~/.config/waybar/launch.sh

README.org

@@ -17,6 +17,42 @@ I use stow to deploy all this to where it need to go (mostly ~/.confg).
 ** starship
 ** tmux
 ** waybar
+*** WireGuard Module
+The Waybar includes a custom WireGuard VPN status module that shows connection status, TX/RX stats, and peer info.
+
+Setup:
+
+1. Install openresolv (needed by wg-quick for DNS):
+   #+begin_src bash :tangle no
+   sudo pacman -S openresolv
+   #+end_src
+
+2. Configure sudo for wg-quick (required for click-to-toggle binds):
+   #+begin_src bash :tangle no
+   echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/wg-quick" | sudo tee /etc/sudoers.d/wireguard
+   #+end_src
+
+3. Create a WireGuard config (if not exists):
+   #+begin_src bash :tangle no
+   sudo cp /etc/wireguard/work-laptop.conf /etc/wireguard/
+   sudo chmod 600 /etc/wireguard/work-laptop.conf
+   #+end_src
+
+4. Refresh Waybar to pick up new config:
+   #+begin_src bash :tangle no
+   killall -q waybar && waybar -c ~/.config/waybar/config.jsonc & -s ~/.config/waybar/style.css &
+   #+end_src
+
+Or use the launch script:
+   #+begin_src bash :tangle no
+   ~/.config/waybar/launch.sh
+   #+end_src
+
+Keybinds:
+- ~$mainMod+Ctrl+V~ — Connect WireGuard (work-laptop)
+- ~$mainMod+Ctrl+Shift+V~ — Disconnect WireGuard
+
+The module polls /usr/bin/wg every 10 seconds. It shows a lock icon with TX/RX when connected, or an unlock icon when disconnected.
 ** Wireplumber
 ** wofi
 ** yazi

doom/.config/doom/README.org

@@ -112,7 +112,9 @@ My current workflow consist in having the 3-5 files I work on open in vertical s
 #+begin_src emacs-lisp
 (map! :leader
       (:prefix ("w" . "window")
-       :desc "Minimize window" "O" #'minimize-window))
+       :desc "Minimize window" "O" #'minimize-window)
+      (:prefix ("z" . "Personal")
+       :desc "Hermes Agent" "h" #'gortium/hermes-vterm))
 #+end_src
 
 ** Ultra-scroll
@@ -1830,6 +1832,25 @@ Org-AI
   (org-ai-install-yasnippets)) ; if you are using yasnippet and want `ai` snippets
 #+end_src
 
+** +Hermes Agent+
+Hermes Agent runs on lazyworkhorse server. Launched via SSH in a vterm buffer.
+
+#+begin_src emacs-lisp
+(after! vterm
+  (defun gortium/hermes-vterm ()
+    "Launch Hermes Agent in vterm via SSH to lazyworkhorse (CLI mode)."
+    (interactive)
+    (let ((buf (get-buffer-create "*hermes*")))
+      (switch-to-buffer buf)
+      (unless (and (eq major-mode 'vterm-mode)
+                   (get-buffer-process buf))
+        (vterm-mode)
+        (let ((proc (get-buffer-process buf)))
+          (when proc
+            (process-send-string
+             proc "ssh -t lazyworkhorse 'docker exec -it hermes /opt/hermes/.venv/bin/hermes'\n")))))))
+#+end_src
+
 * Tramp
 Remote connection to server inside emacs (with all my config) <3
 

doom/.config/doom/config.el

@@ -18,7 +18,9 @@
 
 (map! :leader
       (:prefix ("w" . "window")
-       :desc "Minimize window" "O" #'minimize-window))
+       :desc "Minimize window" "O" #'minimize-window)
+      (:prefix ("z" . "Personal")
+       :desc "Hermes Agent" "h" #'gortium/hermes-vterm))
 
 (use-package! ultra-scroll
   :init
@@ -1053,6 +1055,20 @@ DIFF:
       :desc "GPT generate commit"
       "g" #'gortium/magit-gptel-generate-commit)
 
+(after! vterm
+  (defun gortium/hermes-vterm ()
+    "Launch Hermes Agent in vterm via SSH to lazyworkhorse (CLI mode)."
+    (interactive)
+    (let ((buf (get-buffer-create "*hermes*")))
+      (switch-to-buffer buf)
+      (unless (and (eq major-mode 'vterm-mode)
+                   (get-buffer-process buf))
+        (vterm-mode)
+        (let ((proc (get-buffer-process buf)))
+          (when proc
+            (process-send-string
+             proc "ssh -t lazyworkhorse 'docker exec -it hermes /opt/hermes/.venv/bin/hermes'\n")))))))
+
 ;; set `tramp-direct-async-process' locally in all ssh connections
 (connection-local-set-profile-variables
  'remote-direct-async-process

hypr/.config/hypr/hyprland.conf

@@ -147,7 +147,8 @@ animations {
 
 # See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
 dwindle {
-    pseudotile = true # Master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
+    # Note: pseudotile variable removed in 0.55+. Use `pseudo` dispatcher to toggle per-window.
+    # Bound to $mainMod + P below.
 
     # This prevents the layout from collapsing if you close one window
     preserve_split = true # You probably want this
@@ -219,14 +220,19 @@ bind = $mainMod, E, exec, $editor
 bind = $mainMod, V, togglefloating,
 bind = $mainMod, R, exec, $menu
 bind = $mainMod, Z, exec, $zen
-#bind = $mainMod, P, pseudo, # dwindle
-bind = $mainMod, P, togglesplit, # dwindle
+# togglesplit removed as standalone dispatcher in 0.55+; use `layoutmsg togglesplit` instead
+bind = $mainMod, P, pseudo, # dwindle
 bind = $mainMod, N, movecurrentworkspacetomonitor, -1
 bind = $mainMod SHIFT, N, movecurrentworkspacetomonitor, +1
 bind = $mainMod, X, swapwindow
 bind = $mainMod, B, exec, python /home/tpouplier/ExoKortex/4-Automata/recordntrans/record_transcribe.py
 # bind = $mainMod, G, exec, nerd-dictation end
 bind = $mainMod, A, exec, $music
+bind = $mainMod, C, exec, emacsclient -n -c -e '(gortium/hermes-vterm)'
+
+# WireGuard VPN toggle (uses config file: /etc/wireguard/work-laptop.conf)
+bind = $mainMod CTRL, V, exec, sudo wg-quick up work-laptop
+bind = $mainMod CTRL SHIFT, V, exec, sudo wg-quick down work-laptop
 
 # Full screen
 bind = SUPER, F, fullscreen 

local/.local/share/applications/qet-xephyr.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Name=QET (Xephyr)
+Comment=QElectroTech in nested X server for Wayland compatibility
+Exec=/home/tpouplier/ExoKortex/4-Automata/dotfiles/scripts/qet-xephyr.sh
+Icon=qelectrotech
+Type=Application
+Categories=Graphics;Engineering;
+Terminal=false

scripts/qet-xephyr.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Launch QElectroTech in a nested Xephyr X server with Openbox
+# Works around Wayland drag-and-drop issue in QET
+
+XEPHYR_PID=""
+
+cleanup() {
+    kill $XEPHYR_PID 2>/dev/null
+    exit 0
+}
+trap cleanup SIGINT SIGTERM
+
+Xephyr -screen 1920x1080 :1 -title QET -br &
+XEPHYR_PID=$!
+
+sleep 1
+DISPLAY=:1 openbox &
+sleep 0.5
+DISPLAY=:1 qelectrotech &
+
+wait $XEPHYR_PID

scripts/wireguard-status.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# wireguard-status.sh -- JSON status for Waybar
+# Outputs: {"text":"...","class":"connected|disconnected","tooltip":"..."}
+#
+# Waybar config example (in ~/.config/waybar/config.jsonc):
+#   "custom/wireguard": {
+#       "exec": "$HOME/.config/waybar/scripts/wireguard-status.sh",
+#       "interval": 10,
+#       "return-type": "json"
+#   }
+
+set -euo pipefail
+
+# --- Config -------------------------------------------------------
+ICON_LOCKED="\uf023"       # nf-fa-lock (FontAwesome)
+ICON_UNLOCKED="\uf09e"     # nf-fa-unlock
+# Override with environment variables if set:
+ICON_LOCKED="${WG_ICON_LOCKED:-$ICON_LOCKED}"
+ICON_UNLOCKED="${WG_ICON_UNLOCKED:-$ICON_UNLOCKED}"
+
+# --- Helpers ------------------------------------------------------
+die() { echo "$*" >&2; exit 1; }
+
+# Find the wg binary — works on NixOS, standard Linux, etc.
+find_wg() {
+    if command -v wg &>/dev/null; then
+        echo "wg"
+    elif [ -x /run/current-system/sw/bin/wg ]; then
+        echo "/run/current-system/sw/bin/wg"
+    elif [ -x /usr/bin/wg ]; then
+        echo "/usr/bin/wg"
+    else
+        return 1
+    fi
+}
+
+# Find the ip binary
+find_ip() {
+    if command -v ip &>/dev/null; then
+        echo "ip"
+    elif [ -x /run/current-system/sw/bin/ip ]; then
+        echo "/run/current-system/sw/bin/ip"
+    elif [ -x /usr/sbin/ip ]; then
+        echo "/usr/sbin/ip"
+    elif [ -x /sbin/ip ]; then
+        echo "/sbin/ip"
+    else
+        return 1
+    fi
+}
+
+format_bytes() {
+    local bytes=$1
+    if [ "$bytes" -lt 1024 ]; then
+        echo "${bytes}B"
+    elif [ "$bytes" -lt $((1024 * 1024)) ]; then
+        echo "$(awk "BEGIN { printf \"%.1f KiB\", $bytes / 1024 }")"
+    elif [ "$bytes" -lt $((1024 * 1024 * 1024)) ]; then
+        echo "$(awk "BEGIN { printf \"%.1f MiB\", $bytes / (1024 * 1024) }")"
+    else
+        echo "$(awk "BEGIN { printf \"%.2f GiB\", $bytes / (1024 * 1024 * 1024) }")"
+    fi
+}
+
+# --- Main ---------------------------------------------------------
+
+WG_BIN=$(find_wg 2>/dev/null) || {
+    # wg not installed — report as disconnected
+    printf '{"text":"%s","class":"disconnected","tooltip":"WireGuard not installed"}\n' "$ICON_UNLOCKED"
+    exit 0
+}
+
+IP_BIN=$(find_ip 2>/dev/null) || true
+
+# Find all WireGuard interfaces
+INTERFACES=$("$WG_BIN" show interfaces 2>/dev/null) || {
+    # No WireGuard interfaces exist (wg module not loaded?)
+    printf '{"text":"%s","class":"disconnected","tooltip":"No WireGuard interfaces"}\n' "$ICON_UNLOCKED"
+    exit 0
+}
+
+# Parse into array, handling possible single-line space-separated output
+IFS=' ' read -ra ifaces <<< "$INTERFACES"
+if [ ${#ifaces[@]} -eq 0 ]; then
+    printf '{"text":"%s","class":"disconnected","tooltip":"No WireGuard interfaces"}\n' "$ICON_UNLOCKED"
+    exit 0
+fi
+
+# Just use the first interface (most setups have one)
+IFACE="${ifaces[0]}"
+
+# Get transfer stats
+TRANSFER=$("$WG_BIN" show "$IFACE" transfer 2>/dev/null) || {
+    printf '{"text":"%s","class":"disconnected","tooltip":"Cannot read stats for %s"}\n' "$ICON_UNLOCKED" "$IFACE"
+    exit 0
+}
+
+# Parse: "rx_bytes tx_bytes"
+RX_BYTES=$(echo "$TRANSFER" | awk '{print $1}')
+TX_BYTES=$(echo "$TRANSFER" | awk '{print $2}')
+
+RX_HUMAN=$(format_bytes "${RX_BYTES:-0}")
+TX_HUMAN=$(format_bytes "${TX_BYTES:-0}")
+
+# Get endpoint info for tooltip
+ENDPOINT=$("$WG_BIN" show "$IFACE" endpoints 2>/dev/null | head -1 | awk '{print $2}') || ENDPOINT=""
+PEER=$("$WG_BIN" show "$IFACE" peers 2>/dev/null | head -1) || PEER=""
+
+# Build status line
+STATUS_TEXT="${ICON_LOCKED} \u2193${RX_HUMAN} \u2191${TX_HUMAN}"
+
+# Build tooltip
+TOOLTIP="${IFACE}"
+if [ -n "$PEER" ]; then
+    TOOLTIP="${TOOLTIP}\nPeer: ${PEER}"
+fi
+if [ -n "$ENDPOINT" ]; then
+    TOOLTIP="${TOOLTIP}\nEndpoint: ${ENDPOINT}"
+fi
+# Add IP info if ip is available
+if [ -n "$IP_BIN" ]; then
+    IFACE_IP=$("$IP_BIN" -4 addr show dev "$IFACE" 2>/dev/null | awk '/inet / {print $2}') || IFACE_IP=""
+    if [ -n "$IFACE_IP" ]; then
+        TOOLTIP="${TOOLTIP}\nIP: ${IFACE_IP}"
+    fi
+fi
+TOOLTIP="${TOOLTIP}\nRX: ${RX_HUMAN}\nTX: ${TX_HUMAN}"
+
+printf '{"text":"%s","class":"connected","tooltip":"%s"}\n' "$STATUS_TEXT" "$TOOLTIP"

waybar/.config/waybar/config.jsonc

@@ -28,6 +28,7 @@
            "pulseaudio",
            "bluetooth",
            "network",
+           "custom/wireguard",
            "battery", 
            "custom/exit"
         ]

waybar/.config/waybar/modules.json

@@ -138,6 +138,15 @@
 		//"on-click": "~/dotfiles/.settings/networkmanager.sh"
 	},
 	
+	// wireguard
+	"custom/wireguard": {
+		"exec": "$HOME/.config/waybar/scripts/wireguard-status.sh",
+		"interval": 10,
+		"return-type": "json",
+		"on-click": "kitty sudo wg-quick up work-laptop",
+		"on-click-right": "kitty sudo wg-quick down work-laptop"
+	},
+
 	// battery
 	"battery": {
 		"states": {

waybar/.config/waybar/style.css

@@ -213,6 +213,21 @@ tooltip label {
 }
 
 /* custom modules */
+#custom-wireguard {
+    margin: 0px 0px 0px 5px;
+    padding: 1px 8px 0px 8px;
+    font-size: 16px;
+    color: @text;
+    border-radius: 5px;
+    background-color: @set;
+}
+#custom-wireguard.connected {
+    background-color: @color5;
+}
+#custom-wireguard.disconnected {
+    background-color: @set;
+}
+
 #custom-exit {
     margin: 0px 18px 0px 5px;
     padding: 0px;

zsh/.zshrc

@@ -19,6 +19,33 @@ alias emacs="emacsclient -c -a emacs"
 # Opencode
 alias oc="opencode"
 
+# Hermes Agent - SSH directly to remote server
+alias hermes="ssh -t lazyworkhorse 'docker exec -it hermes /opt/hermes/.venv/bin/hermes'"
+
+hermes-cp() { 
+  if [ $# -eq 0 ]; then
+    echo "Usage: hermes-cp <file_or_directory> [...]"
+    echo ""
+    echo "Copies files/directories from your Arch laptop into the Hermes"
+    echo "agent container at /opt/data/home/ preserving directory structure."
+    echo ""
+    echo "Examples:"
+    echo "  hermes-cp document.pdf              # single file"
+    echo "  hermes-cp *.pdf                      # multiple files (glob)"
+    echo "  hermes-cp manuals/                   # whole directory"
+    echo "  hermes-cp manuals/ keyence-docs/     # multiple items"
+    echo ""
+    echo "To copy to a different destination inside the container:"
+    echo "  tar -czf - . | ssh gortium@lazyworkhorse \\"
+    echo "    \"docker exec -i hermes sh -c 'cd /opt/data/projects && tar -xzf -'\""
+    return 1
+  fi
+  # tar everything into a single SSH pipe, extract inside container
+  # Supports: single files, directories, glob patterns, mixed args
+  tar -czf - "$@" | ssh gortium@lazyworkhorse \
+    "docker exec -i hermes sh -c 'cd /opt/data/home && tar -xzf -'"
+}
+
 # Yazi
 alias y="yazi"
 function yy() {