{"data":{"items":[{"id":"f1027af9-6b3d-4cab-aed8-80b0e4ee3cc7","excerpt":"🖥️ The r/hermesagent VPS Megathread - Community-Curated Guide — *Last updated: 3 Jun 2026 · Sources: 10+ subreddit threads, 300+ community comments*\n\n---\n\n## TL;DR — The Subreddit's Consensus\n\n| Decision | Community Pick | Runner-Up |\n|----------|---------------|-----------|\n| **Best VPS provider** | Hetzner (€5-10/mo)","url":"https://www.reddit.com/r/hermesagent/comments/1tw9lbd/the_rhermesagent_vps_megathread_communitycurated/","role":"request","weight":1.1993619,"occurredAt":"2026-06-04T01:46:36.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"hermesagent","intent":"recommendation_request","painScore":0.23316051,"sentiment":0.5084746,"confidence":0.9725919,"matchedPatterns":["recommend","free_tier","workaround"],"statement":"The workaround is to from within the container, but that doesn't survive container rebuilds.","title":"🖥️ The r/hermesagent VPS Megathread - Community-Curated Guide","body":"*Last updated: 3 Jun 2026 · Sources: 10+ subreddit threads, 300+ community comments*\n\n---\n\n## TL;DR — The Subreddit's Consensus\n\n| Decision | Community Pick | Runner-Up |\n|----------|---------------|-----------|\n| **Best VPS provider** | Hetzner (€5-10/mo) | Hostinger (~$10/mo) |\n| **Docker or bare metal?** | Bare metal / direct OS | Docker only for complex multi-app setups |\n| **Best cost-saving model** | DeepSeek V4 Flash | DeepSeek V4 Pro for complex tasks |\n| **Best free VPS** | Oracle Cloud (4 CPU, 24GB RAM) | GCP e2-micro free tier |\n| **Remote access** | Tailscale | SSH + Pinggy for quick tunnels |\n| **Cheapest option overall** | Euronodes $3.70/mo | Webdock.io €2.15/mo |\n| **Managed Hermes hosting** | Agent37, Moltis ($7/mo) | CageBox (Edit 6-4-26 registration now open. Details in comment section.) |\n\n---\n\n## Part 1: VPS Provider Comparison\n\n### 🥇 Tier 1 — Community Favorites\n\n**Hetzner**\n- **Price:** From ~€5/mo (shared x86, 4GB RAM); ~€8-12/mo for 8GB\n- **Verdict:** The most-recommended provider across all threads. Stable, scalable, great price-to-performance. \"Hands down the most reliable & economical option.\"\n- **Watch for:** Account closures reported by some users (rare but real). Video verification at signup. Some regions report capacity limits.\n- **Best for:** Users who want maximum reliability at minimum cost and can handle a slightly less beginner-friendly setup.\n\n**Hostinger**\n- **Price:** From ~$8-12/mo (shared x86, 4GB RAM); KVM 1-2 commonly recommended\n- **Verdict:** The most accessible option for beginners. Simple UI, good support. Backups are an upsell ($6/mo — skip it, use GitHub for configs instead). 30-day money-back guarantee lets you test risk-free.\n- **Community experiences:** Mixed. Beginners appreciate the easy onboarding and one-click Hermes container. But advanced users report SSH tunnel fragility — tunnels break on restart and need manual reconnection. Several users report migrating to Hetzner after hitting Docker complexity and tunnel issues on Hostinger. The Docker container image is often outdated (lagging behind `hermes update`). Consensus: use the Ubuntu VM option, NOT the Docker container — install Hermes directly with the bash installer instead.\n- **Discount codes:** `vpsnest` mentioned across multiple threads\n- **Best for:** Beginners who want a smooth onboarding experience and don't mind slightly higher cost. Not recommended for long-running unattended setups unless you're using Tailscale instead of raw SSH tunnels.\n\n### 🥈 Tier 2 — Strong Alternatives\n\n| Provider | Price | RAM | Notes |\n|----------|-------|-----|-------|\n| **Contabo** | ~$8-15/mo | 8-16GB | Best specs-per-dollar. Runner-up for Hetzner refugees |\n| **OVH** | $20/mo | 24GB | Massive RAM for the price. 4vCPU |\n| **Vultr** | $6-12/mo | 1-2GB | $250 free credits (30 days). Good for testing |\n| **IONOS** | ~$10-20/mo | Varies | Size L plan popular. Stable uptime |\n| **PrimeClaws** | $20/mo | 8GB | Small provider, responsive Discord support. OP's choice in one thread |\n| **Racknerd** | ~$10-15/mo | Varies | Solid reliability, sub-10ms for same-region users |\n\n### 🥉 Tier 3 — Budget / Free Options\n\n| Provider | Price | Specs | Notes |\n|----------|-------|-------|-------|\n| **Oracle Cloud** | Free | 4 CPU, 24GB RAM, 200GB SSD | Most powerful free option. **Risk:** accounts can be terminated without notice. Upgrade to PAYG with $1 cap for safety |\n| **VPSDime** | \"Dirt cheap\" | Varies | No marketing, strong word-of-mouth. Reliable |\n| **Euronodes** | $3.70/mo | Varies | The absolute cheapest mentioned |\n| **Webdock.io** | €2.15/mo | Varies | Cheapest managed option |\n| **GCP e2-micro** | Free | 1 vCPU, 1GB RAM | Free within tier limits. Set billing alerts |\n| **AWS Lightsail** | ~$15/mo | Varies | Fixed billing. May require 3-4 months billing history to upgrade |\n| **Tencent Cloud** | ~$10/year | Varies | Extremely cheap annual plans |\n\n### ⚠️ Avoid / Caution\n\n| Provider | Reason |\n|----------|--------|\n| **Oracle Cloud (unupgraded)** | Can terminate accounts without warning. Always upgrade to PAYG with a $1 cap |\n| **GCP credits** | Easy to forget to turn off; surprise $100 bills reported. Set aggressive billing alerts |\n| **Any long-term contract** | Start monthly. Don't commit to annual before validating your workflow |\n\n---\n\n## Part 2: Docker vs Bare Metal — The Great Debate\n\n### Community Consensus: Bare Metal Wins for Single-Purpose VPS\n\nAcross 12+ threads and 80+ comments, the overwhelming majority runs Hermes **directly on the OS** — not in Docker.\n\n**Arguments for bare metal:**\n- Docker adds unnecessary complexity for a single-service VPS\n- Easier debugging — no container networking or volume mount issues\n- Use OS-level isolation instead: dedicated user, firewall, file permissions\n- Hermes lives entirely in `~/.hermes` — no app-level dependencies outside the venv\n- \"You're basically just buying a container like Docker\" when using Hetzner's built-in load balancing/firewall\n\n**When Docker makes sense:**\n- Running multiple services on the same VPS (Hermes + OpenClaw + other tools)\n- You need reproducible deployments across machines\n- You want Docker's terminal sandbox backend for Hermes\n- Enterprise/production setups where container orchestration is standard\n\n**If you use Docker:**\n- Get the container running *first*, then restore backups into it\n- Use Docker's terminal backend: `terminal.backend: docker`\n- Set up proper volume mounts for persistence\n- Consider Coolify with storage volumes for data persistence across restarts\n- **⚠️ Hostinger Docker users beware:** The Hostinger Hermes Docker image often lags months behind the latest release. Users report being stuck on outdated versions with no way to access new features (like xAI OAuth). The workaround is to `hermes update` from within the container, but that doesn't survive container rebuilds. Use the Ubuntu VM template instead and install with the bash installer — you control updates.\n\n---\n\n## Part 3: Setup Best Practices (From the Community)\n\n### 1. User & Permissions\n- **Create a dedicated user** (`hermes`) — never run as root\n- Grant sudo only if needed for specific tasks (package installs, Docker management)\n- No root access, no access to personal home directory\n- Use group-based file permissions for shared resources\n\n### 2. Remote Access\n- **Tailscale** is the community standard — VPN that puts your machines on the same private network. One install on VPS, one on your machine. No SSH tunnels, no reverse proxies needed. Survives restarts reliably.\n- **Why not raw SSH tunnels?** Multiple Hostinger users report SSH tunnels breaking on every VPS restart or network blip — requiring manual reconnection. Tailscale eliminates this entirely. If you must use SSH, consider `autossh` for automatic reconnection.\n- **Pinggy** for quick public URLs: `ssh -p 443 -R0:localhost:8080 qr@free.pinggy.io` (no Nginx config needed)\n- **Syncthing** for continuous file sync between local and VPS\n- VSCode SSH for GUI file management on the VPS\n\n### 3. Networking\n- Cloudflare Tunnel + domain for public portal access\n- Hetzner/Tailscale built-in firewalls for access control\n- Only expose: Telegram webhook port, Discord bot port, or whatever messaging platform you use\n\n### 4. Version Control\n- Store configs and skills in a **private GitHub repo**\n- Use a restricted GitHub PAT — create new repos, don't grant access to personal ones\n- Separate GitHub account for the agent as an alternative\n\n### 5. Backups\n- `hermes backup` — built-in, creator-confirmed\n- Critical: copy `~/.hermes/` (config, skills, personalities, memories, instructions)\n- Skip: session logs (can reach GBs; not needed for recovery)\n- Store backups off-VPS (GitHub, S3, local machine)\n- **Cron daily backup:** `0 3 * * * hermes backup && rsync -avz ~/.hermes/backups/ user@local:~hermes-backups/`\n\n### 6. Security\n- **Agent Vault** (Infisical-backed): agents use secrets without reading underlying values — [docs.agent-vault.dev/guides/hermes-on-vps](https://docs.agent-vault.dev/guides/hermes-on-vps)\n- **1Password CLI / Infisical / OpenBao** for external secret storage\n- **Varlock** (open-source): proxy that injects secrets; connects to multiple vault providers\n- Separate credentials: use throwaway Google/Apple/GitHub accounts for the agent\n- Dedicated VPS or VM with nothing else of value on it\n- The \"blast radius\" principle: \"A cheap VPS with boring backups beats a powerful desktop that has your whole life under `/Users`\"\n\n---\n\n## Part 4: Cost Management (aka \"Stop Burning Money\")\n\n### The #1 Insight: LLM Costs Dominate — Not VPS Costs\n\nA $5/mo VPS + $20/mo API bill is the real monthly total. The community's cost-control playbook:\n\n### Model Selection (Cost-Effective)\n\n| Model | Cost Tier | Use For |\n|-------|-----------|---------|\n| **DeepSeek V4 Flash** | Near-free | Daily driver. 96% cache hit rate. Very fast |\n| **DeepSeek V4 Pro** | Very cheap | Complex tasks that need more reasoning |\n| **OpenAI Codex subscription** | $20/$100/$200 flat | Fixed monthly ceiling — no surprise bills |\n| **Gemini 2.5 Flash Lite** | Free tier | Vision tasks, Google AI Studio |\n| **Nous Portal** | Free | Free models for experimentation |\n| **Nemotron 120B (NVIDIA NIM)** | Free | Good local alternative |\n\n### Configuration Tuning\n\n| Setting | Default | Recommended | Why |\n|---------|---------|-------------|-----|\n| `agent.max_turns` | 90 | 40-60 | Prevents runaway loops from burning credits |\n| `kanban.max_in_progress` | (varies) | 1 | **Critical** — prevents spawn storms. 288 workers burning $5 in 2.5hrs is the canonical horror story |\n| `kanban.failure_limit` | 2 | 2-3 | Circuit breaker for failed workers |\n| `max_runtime_seconds` | (none) | 600-900 | Hard timeout per kanban task |\n| Audit default tools | (all on) | Disable unused | Default tool schemas add ~7K tokens/turn |\n\n### The Kanban Loop Bug (Known Issue)\n- Workers that exit cleanly (rc=0) without calling `kanban_complete`/`kanban_block` **don't count as failures**\n- Dispatcher sees \"completed\" → re-spawns every 60 seconds → infinite credit burn\n- Fix: lower `max_in_progress`, add `max_runtime_seconds`, archive and restart fresh\n- Known edge case in the codebase (~line 5384)\n\n### Cost Philosophy\n- Set a **monthly ceiling** ($50-100) while learning — optimize down later\n- Use frontier models to figure out architecture, then switch to DeepSeek for daily use\n- Don't stress about cost optimization in month 1 — find your workflow first\n- `hermes insights` to audit token burn by task/skill\n\n---\n\n## Part 5: Local vs VPS — The Decision Framework\n\n### Run on a VPS if:\n- You need 24/7 uptime (laptop closes, agent dies)\n- You want clean separation from personal files (blast radius)\n- You run overnight cron jobs or scheduled tasks\n- Your laptop goes to sleep and interrupts workflows\n- You don't have old hardware lying around\n\n### Run locally if:\n- You have a desktop that's always on, or a Mac Mini / Mini PC\n- 24/7 uptime isn't critical\n- You want zero monthly hosting costs\n- You're running local models and need GPU/CPU access\n- You have a Raspberry Pi 4 (4GB+) or old laptop to dedicate\n\n### The Middle Ground — Mini PC / Dedicated Hardware\n- **Intel N100/N150 mini PCs** (~$150-250): \"More than overkill\" for Hermes\n- **Raspberry Pi 4 (4GB)**: Uses <2GB RAM for Hermes. Works for hobby use\n- **2012 Mac Mini**: Still viable — one user runs on this daily\n- **Intel NUC**: Popular in the homelab crowd for Proxmox + VM setup\n- **Old laptop with 4GB RAM**: Fanless Celeron runs 24/7 at near-zero power cost\n\n### Proxmox VM Setups (Advanced Homelab)\n- Run Hermes in its own VM with a dedicated non-root user\n- Place the VM on a completely separate VLAN — no access to other services unless you explicitly poke holes\n- Gives you VPS-grade isolation on local hardware: snapshots, backups, resource limits\n- One user reports flawless operation with DeepSeek V4 Pro, ~10% cache savings, and zero issues after initial setup burn-in\n- Best of both worlds: local hardware cont","offTopic":false},{"id":"21ded913-696d-4047-b24a-c0d5c373f52d","excerpt":"VPS & Deployment Megathread — Hermes Agent (June 2026) — **LAST UPDATED:** June 21, 2026  \n**Sourced from:** 9+ r/hermesagent threads (200+ comments), official Nous docs, GitHub raw docs, external deployment guides, and the Hermes Dockerfile source.\n\n---\n\n## TL;DR — What Should I Do?\n\n| Decision | Community Pick | Runn","url":"https://www.reddit.com/r/hermesagent/comments/1ucke01/vps_deployment_megathread_hermes_agent_june_2026/","role":"demand","weight":1.1551968,"occurredAt":"2026-06-22T13:19:25.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"hermesagent","intent":"alternative_search","painScore":0.26712546,"sentiment":0.18681319,"confidence":0.9116673,"matchedPatterns":["how_can_i","alternative_to","switching_from","free_tier","missing_feature"],"statement":"| Preventing API key leaks | Setup overhead | | **Zyte / Scrapingbee** | CAPTCHA solving | Paid | Unblocking headless browsers | Ongoing cost | | **unblockingapi.com** | CAPTCHA solving | Paid | Alternative to Zyte | Less established | | *…","title":"VPS & Deployment Megathread — Hermes Agent (June 2026)","body":"**LAST UPDATED:** June 21, 2026  \n**Sourced from:** 9+ r/hermesagent threads (200+ comments), official Nous docs, GitHub raw docs, external deployment guides, and the Hermes Dockerfile source.\n\n---\n\n## TL;DR — What Should I Do?\n\n| Decision | Community Pick | Runner-Up | Key Factor |\n|----------|---------------|-----------|------------|\n| Deployment type | **Bare metal on dedicated machine** | VM with snapshots (Proxmox) | Docker adds friction for most |\n| VPS provider | **Hetzner** (€4-8/mo) | Netcup ($10-13/mo), Oracle free tier | Avoid Hostinger — affiliate hype |\n| Remote access | **Tailscale** (mesh VPN) | Cloudflare Tunnel + auth | Zero open ports > port forwarding |\n| Local alternative | **Used Dell Optiplex / Mini PC** | Raspberry Pi 5 (8GB) | $100-400 one-time vs $10-30/month |\n| Docker choice | **Avoid for active dev** | Use for stable production only | Exploration = VM; stability = Docker |\n\n---\n\n## Part 1: The Deployment Landscape\n\n### 🥇 Tier 1: Bare Metal / Root Install (Community Favorite)\n\n**What it is:** Install Hermes directly on the OS — no Docker, no VM layer. `curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash`\n\n**Why the community prefers it:**\n- Hermes has full filesystem access — can install tools, manage services, fix system issues\n- No Docker permission headaches, no volume mount confusion, no missing dependencies\n- \"Hermes needs more than a container to run optimally. It needs an entire tech stack.\" — u/Shady_Prospector\n- \"I want it to run free like a lion in Africa\" — u/PurpleParrot1999\n- Direct access means Hermes can fix real problems: one user described Hermes diagnosing a dual-starting systemd service with zero config — \"no need to link drives, give temporary access rights, just straight: 'check why this service runs twice', and it fixed it\"\n\n**Watch for:**\n- Security: Hermes has full access to your machine. Use a dedicated box or VM.\n- Backups: Snapshot or back up ~/.hermes regularly. \"The very second I got my Hermes config to a workable state I snapshot that MF\" — u/100PercentJake\n- Log rotation: Session logs and SQLite state.db fill disks fast on active use (u/Profanonyme1337)\n- Systemd on Linux: `hermes gateway install --system` for auto-start on boot, clean restarts, proper logging\n- Launchd on macOS: `hermes gateway install` handles this\n\n**Best for:** Active development, tinkering, local-only setups, anyone who wants Hermes to manage the machine\n\n---\n\n### 🥈 Tier 2: VM with Snapshots (Sanity Saver)\n\n**What it is:** Run Hermes in a virtual machine — Proxmox, QEMU/KVM, VirtualBox, UTM, VMware. Give it root inside the VM.\n\n**Why:**\n- Full OS access inside the VM, isolation from host\n- Snapshots are the killer feature: break something? Revert in seconds\n- \"I prefer the hypervisor route because I can right click and hit 'snapshot' and have something to go back to\" — u/100PercentJake\n- Proxmox is the most-cited hypervisor across threads\n- Works on everything: old laptops, N100 mini PCs, Synology NAS, Dell Optiplex\n\n**Best for:** People who want isolation but not Docker restrictions, anyone who tinkers heavily and needs rollback\n\n**Watch for:**\n- RAM overhead: host OS + VM eats RAM. One user moved from VM to bare metal because \"half my system's RAM was [used by] the host OS\"\n- GPU passthrough: if you're running local models, VM GPU passthrough adds complexity\n- Actual guide: Install Linux (Ubuntu/Debian), install dependencies, install Hermes via one-liner, give it sudo, snapshot immediately after config is working\n\n---\n\n### 🥉 Tier 3: Docker (Stable Only)\n\n**What it is:** Official `nousresearch/hermes-agent` image. s6-overlay supervised. One container can host multiple profiles.\n\n**When Docker works:**\n- Your setup is stable and you're not actively adding tools/dependencies\n- You need clean separation between Hermes and host\n- You're running a production gateway that shouldn't touch the host\n- You know Docker well enough to troubleshoot volume mounts, permission issues, and missing tools\n\n**When Docker fails (community consensus):**\n- \"The docker image for hermes is VERY limited. It doesn't have all the tools/skills hermes needs. It doesn't even have a web browser or search!\" — u/halarioushandle\n- \"I find it tricky to keep the system stable and manage access to the host, not to mention the hassle of managing Hermes updates since I had to rebuild everything from scratch\" — u/TransportationLow130\n- \"Dealing with the container issues is not worth it\" — u/radicalscents\n- \"once hermes gets into container, it cannot do any system maintenance work anymore\" — u/This_Maintenance_834\n- Cron jobs inside Docker add complexity — Hermes runs cron internally and Docker constrains that\n- Missing tools: you'll need to install skills, browsers, and system deps after container setup\n\n**Official Docker quickstart:**\n```sh\nmkdir -p ~/.hermes\ndocker run -it --rm \\\n  -v ~/.hermes:/opt/data \\\n  nousresearch/hermes-agent setup\n\n# Gateway mode (background):\ndocker run -d \\\n  --name hermes \\\n  --restart unless-stopped \\\n  -v ~/.hermes:/opt/data \\\n  -p 8642:8642 \\\n  nousresearch/hermes-agent gateway run\n\n# With dashboard:\ndocker run -d \\\n  --name hermes \\\n  --restart unless-stopped \\\n  -v ~/.hermes:/opt/data \\\n  -p 8642:8642 \\\n  -p 9119:9119 \\\n  -e HERMES_DASHBOARD=1 \\\n  nousresearch/hermes-agent gateway run\n```\n\n**Resource minimums (official):**\n| Resource | Minimum | Recommended |\n|----------|---------|-------------|\n| Memory | 1 GB | 2-4 GB (4 GB with browser tools) |\n| CPU | 1 core | 2 cores |\n| Disk | 500 MB | 2+ GB |\n\n**Docker Compose example:**\n```yaml\nservices:\n  hermes:\n    image: nousresearch/hermes-agent:latest\n    container_name: hermes\n    restart: unless-stopped\n    command: gateway run\n    ports:\n      - \"8642:8642\"\n      - \"9119:9119\"\n    volumes:\n      - ~/.hermes:/opt/data\n    environment:\n      - HERMES_DASHBOARD=1\n    deploy:\n      resources:\n        limits:\n          memory: 4G\n          cpus: \"2.0\"\n```\n\n**⚠️ Avoid browser-based VPS consoles** (Hetzner Cloud, etc.) for the initial docker run — they corrupt special characters. Connect via SSH instead.\n\n**Multi-profile in one container** (official, s6-supervised):\n```sh\ndocker exec hermes hermes profile create work\ndocker exec hermes hermes -p work gateway start\n```\n\n**Docker pro-tip:** Mount `/var/run/docker.sock` if you want Hermes to manage other containers from inside its own container. This is an advanced pattern — u/jereminius reports it works for browser tools and container management.\n\n---\n\n### ⚠️ Tier 4: Hybrid / Experimental\n\n**Host-level Hermes + Docker sub-agents** — the OP of \"Docker limitations\" proposed this and it was validated by multiple commenters as technically feasible:\n- One Hermes installed directly on the host (root access) as \"admin\"\n- Sub-agents in individual Docker containers for isolated tasks\n- Plumbing via Ansible, Puppet, or SSH keys between them\n- \"Running a host-level agent that orchestrates dockerized sub-agents is doable with something like Ansible or Puppet for the plumbing\" — u/Automatic-Cover-1831\n\n**Distrobox + Quadlet** (u/Necessary_Two_9669): Containerized with better host integration than plain Docker.\n\n**Terraform + Ansible + Podman (rootless, quadlet)** for VPS deployment (u/_zendar_).\n\n---\n\n## Part 2: VPS Provider Comparison\n\n| Provider | Price/Month | Verdict | Notes |\n|----------|------------|---------|-------|\n| **Hetzner** | €4-8 | 🥇 Community pick | Reliable, SSH-friendly, good price/perf |\n| **Netcup** | $10-13 | 🥈 Solid | Used by multiple community members |\n| **Oracle Cloud** | Free tier | 🥈 Best free option | Generous free tier, block storage, Tailscale-friendly. Setup is \"corporate tech\" (not user-friendly). Quality can degrade after initial allocation. Limited availability by region. |\n| **AWS EC2** | Varies ($200 free credit) | 🥉 Temporary | Free credits work but burns fast. ~$1.50/day on modest instance. |\n| **Hostinger** | Varies | ⚠️ Avoid | Called \"biggest culprit\" in affiliate marketing by multiple users. \"These people are getting paid big bucks\" — u/Creative_Diver3492 |\n| **Hetzner Storage Share** | $4/mo | 🥉 | Good companion storage, not for compute |\n\n**Real community budget (from u/Background-Remote765):** Netcup VPS ($10-13/mo) + Hetzner Storage ($4/mo) + DeepSeek API ($5-10/mo) = **~$30-35/month total** — replacing Spotify, Google ecosystem, and AI subscriptions.\n\n---\n\n## Part 3: Networking & Remote Access\n\n### 🥇 Tailscale (mesh VPN) — Community Pick\n\n\"Use Tailscale, runs cleanly\" — u/xyesca\n\n- Zero open ports. Hermes dashboard accessible only to devices on your Tailscale network.\n- Works with VPS, home server, and mobile.\n- Free for personal use (up to 100 devices).\n- Combined with Cloudflare Tunnel for public-facing services if needed.\n\n### 🥈 Cloudflare Tunnel\n\n- Access Hermes Dashboard from anywhere without opening ports.\n- **Security note:** Keep \"mission control\" (third-party admin UIs) on Tailscale only, not on public Cloudflare tunnels — \"mission control exposed on a public tunnel is a wider attack surface than you need\" — u/Profanonyme1337\n- Combine with Cloudflare Zero Trust for authentication layer.\n\n### 🥉 SSH Tunnels (Manual)\n\nThe OP of the SSH tunnel thread found a working pattern:\n1. SSH config forwards local ports to remote VPS\n2. Dashboard accessible at `http://127.0.0.1:9119` locally\n3. Hermes Desktop connects to that forwarded port\n\n**Critical fix they discovered:** Enable the `dashboard_auth/basic` plugin. Without it, the dashboard silently fails to start when running as a systemd background process — and the Desktop app can't authenticate.\n\n### Other options mentioned: NetBird, Pangolin (self-hosted VPN)\n\n---\n\n## Part 4: Security Hardening\n\n### Community-Vetted Practices\n\n**Minimal VPS setup** (from u/orthogonal-ghost on Hetzner):\n1. Create a non-root `hermes` user with sudo (but don't give it the sudo password — Hermes prompts when it needs elevation)\n2. Disable root login and password authentication in SSH config\n3. Restrict firewall to approved IPs only (or Tailscale-only access)\n4. Keep Hermes on its own VPS — don't share with other services\n\n**Dashboard security** (official docs, hardened June 2026 after MCP-config persistence campaign):\n- The dashboard auth gate is now **mandatory** on non-loopback binds\n- Easiest path: `HERMES_DASHBOARD_BASIC_AUTH_USERNAME` + `HERMES_DASHBOARD_BASIC_AUTH_PASSWORD`\n- For public exposure: OAuth via Nous Portal or self-hosted OIDC\n- **Never** expose an unauthenticated dashboard to the internet\n\n**Credential protection:**\n- Use AgentVault (mentioned by u/AnticitizenPrime) to prevent credential leaks\n- Nightly backups to external drive\n- Hermes built-in safeguards prevent leaking env vars/credentials (u/Howard_banister)\n\n**The \"full send\" approach** (u/p_viljaka):\n\"i gave it its own linux VPS and basically 'full send', it has root / sudo — yolo, i told its his own box and take care of it and dont fuck around, and no more box'es if it screws up. It seems happy.\"\n\nThis works because: Hermes on its own VPS with no shared services can't hurt anything beyond itself. Combined with backups, this is lower-risk than it sounds.\n\n---\n\n## Part 5: Local Hardware Alternatives\n\nSkip the VPS entirely. The community overwhelmingly prefers local hardware:\n\n| Hardware | Cost | RAM | Notes |\n|----------|------|-----|-------|\n| Used Dell Optiplex | ~$100 | 32GB DDR4 | Homelab gold. Proxmox-ready. |\n| Raspberry Pi 5 | ~$80 | 8GB + NVMe | \"No issues so far\" for gateway-only |\n| Used Mac Mini | ~$200-400 | 16GB+ | \"No fan, low consumption, works perfect\" |\n| Intel N100 Mini PC | ~$150 | 16GB | \"Smallest VM possible was enough\" |\n| Old laptop (any) | Free-$100 | Varies | Reformat with Linux, install Hermes directly |\n| Orange Pi w/ NPU | ~$100 | Varies | Self-hosted with NPU acceleration |\n| HP ProDesk (salvaged) | Free | Varies | \"Found being thrown away on the side of the road\" |\n\n**Why local wins:**\n- No monthly cost after hardware purchase\n- No latency between you and your agent\n- Full","offTopic":false},{"id":"5cb47378-89f1-4740-8180-c43a3f1a60ae","excerpt":"Complete Guide: How to Host Hermes Agent on a Hetzner VPS — Hermes Agent (from Nous Research) is an open-source, self-improving AI agent that goes far beyond a simple chatbot. It features a built-in learning loop: it creates and refines its own skills from experience, persists knowledge across sessions, searches past c","url":"https://www.reddit.com/r/WebAfterAI/comments/1t2lwth/complete_guide_how_to_host_hermes_agent_on_a/","role":"demand","weight":0.9518139,"occurredAt":"2026-05-03T13:46:06.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"WebAfterAI","intent":"alternative_search","painScore":0.33,"sentiment":0.8235294,"confidence":0.71564955,"matchedPatterns":["switching_from"],"statement":"* Community favorite: Many users migrate from local setups or other agents (like OpenClaw) to Hetzner for always-on Telegram bots and cron jobs.","title":"Complete Guide: How to Host Hermes Agent on a Hetzner VPS","body":"Hermes Agent (from Nous Research) is an open-source, self-improving AI agent that goes far beyond a simple chatbot. It features a built-in learning loop: it creates and refines its own skills from experience, persists knowledge across sessions, searches past conversations, builds a user model, runs scheduled automations, and integrates seamlessly with messaging platforms like Telegram.\n\nYou can run it on a laptop, but a VPS makes it truly powerful: 24/7 uptime, always-on automations, remote access via Telegram/Discord from your phone, and no draining your local machine. A cheap Hetzner VPS (around €5–10/month) is one of the most popular and cost-effective options - lightweight enough that you don’t need a GPU unless you want fully local inference.\n\n**Why Hetzner VPS for Hermes?**\n\n* Cheap & reliable: CX22 / CPX21-style plans (2 vCPU, 4–8 GB RAM, 40–80 GB NVMe) are perfect and cost \\~€5–10/month.\n* No GPU required for standard use (LLM calls go to OpenRouter, Anthropic, Nous Portal, etc.). Only upgrade to a GPU server if you want local models via Ollama/vLLM.\n* Full control: SSH, Docker optional, easy systemd setup.\n* Community favorite: Many users migrate from local setups or other agents (like OpenClaw) to Hetzner for always-on Telegram bots and cron jobs. \n\nHardware minimum (recommended): 2 vCPU, 4 GB+ RAM, 20 GB disk. The agent itself is a Python/Node process; inference happens externally.  \n  \n**Step 1: Provision Your Hetzner VPS**\n\n1. Go to [hetzner.com/cloud](https://www.hetzner.com/cloud) → Create a new server.\n2. Choose Ubuntu 24.04 (recommended) or 22.04 LTS.\n3. Pick a cheap plan (e.g., CPX21 or similar - 2–4 vCPU, 4–8 GB RAM).\n4. Add your SSH public key (or set a root password - SSH key is strongly preferred).\n5. Deploy and note the public IP.\n\n*Initial SSH:*\n\n    ssh root@YOUR-HETZNER-IP\n\n*Update the system immediately:*\n\n    apt update && apt upgrade -y\n    apt install -y curl git ufw\n\n**Step 2: Secure the Server (Essential for Any VPS)**  \n  \n*Best practice: Run Hermes under a dedicated non-root user.*\n\n    adduser hermes --disabled-password --gecos \"\"\n    usermod -aG sudo hermes\n    echo \"hermes ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/hermes\n    chmod 440 /etc/sudoers.d/hermes\n    \n    # Copy your SSH key\n    mkdir -p /home/hermes/.ssh\n    cp ~/.ssh/authorized_keys /home/hermes/.ssh/ 2>/dev/null || true\n    chown -R hermes:hermes /home/hermes/.ssh\n    chmod 700 /home/hermes/.ssh\n    chmod 600 /home/hermes/.ssh/authorized_keys\n\n*Switch to the hermes user:*\n\n    su - hermes\n\n*Firewall (UFW):*\n\n    sudo ufw default deny incoming\n    sudo ufw default allow outgoing\n    sudo ufw allow ssh\n    sudo ufw enable\n\nOptional but highly recommended: Tailscale for secure access (zero-trust SSH). Many users run *Hermes + Tailscale* so SSH is only possible from your private network.\n\n**Step 3: Install Hermes Agent**  \n  \nAs the hermes user, run the official one-liner (works on Ubuntu/Debian):\n\n    curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash\n\nReload your shell:\n\n    source ~/.bashrc\n\nVerify:\n\n    hermes --version\n    hermes doctor\n\n(The installer pulls Python 3.11+, Node.js 22, ripgrep, ffmpeg, etc. automatically.)  \n  \n**Step 4: Run the Setup Wizard & Configure Your LLM Provider**\n\n    hermes setup\n\n*This walks you through:*\n\n* LLM provider selection (OpenRouter is the most popular - 200+ models including Claude, DeepSeek, Gemini, etc.)\n* API key entry\n* Default model (e.g., gpt-5.5/claude-sonnet-6 or whatever is the current best)\n\n*Quick config commands (after setup):*\n\n    hermes model                  # switch provider/model\n    hermes config set model.provider openrouter\n    hermes config set model.default anthropic/claude-sonnet-4\n\nTip: Start simple with one provider. You can add more later. API costs are the main ongoing expense (\\~$5–20/month for moderate use).\n\n*Approval mode (safety on VPS):*\n\n    hermes config set approval_mode ask\n\n**Step 5: Add Telegram (or Discord/Slack) Integration**  \n  \nHermes shines when you can chat with it from your phone 24/7.\n\n1. Message u/BotFather on Telegram → /newbot → get the bot token.\n2. Message u/userinfobot → get your numeric user ID.\n3. `Add to ~/.hermes/.env: bashTELEGRAM_BOT_TOKEN=your_token_here TELEGRAM_ALLOWED_USERS=your_user_id`\n4. Test: bash`hermes gateway` Message your bot, it should respond.\n\n**Step 6: Run Hermes Persistently as a Systemd Service**  \n  \nDon’t run it in a foreground terminal.   \n  \n*Use the built-in gateway:*\n\n    hermes gateway setup\n    hermes gateway install\n\n*Enable & start:*\n\n    systemctl --user enable --now hermes-gateway\n\n*Check status & logs:*\n\n    systemctl --user status hermes-gateway\n    journalctl --user -u hermes-gateway -f\n\n*Set a working directory for projects (optional but useful):*\n\n    echo 'MESSAGING_CWD=/home/hermes/projects' >> ~/.hermes/.env\n    mkdir -p ~/projects\n    systemctl --user restart hermes-gateway\n\nNow your agent runs 24/7, handles cron jobs, and responds on Telegram even when you’re offline.\n\n**Step 7: Security, Backups & Maintenance (Critical on VPS)**\n\n* API keys: Always in \\~/.hermes/.env with chmod 600.\n* Restrict Telegram: Only your user ID can talk to the bot.\n* Approval mode: Keeps the dangerous actions manual.\n* Backups (daily cron recommended): \n\n&#8203;\n\n    hermes backup # Add to crontab: 0 3 * * * /home/hermes/.local/bin/hermes backup\n\n* Updates: \n\n&#8203;\n\n    hermes backup hermes update hermes config migrate hermes doctor systemctl --user restart hermes-gateway\n\n* Monitor: `journalctl --user -u hermes-gateway --since \"1 hour ago\"`\n\n**Advanced Tips:**\n\n* Skills & self-improvement: Hermes auto-creates skills. Feed it Obsidian vaults, GitHub repos, or custom tools - it gets smarter over time. \n* Sub-agents & coding: Many users pair it with Claude Code or OpenCode Go for full app-building workflows on the same VPS. \n* Local models: If you upgrade to a Hetzner GPU server, use Ollama and point Hermes to `http://localhost:11434/v1`.\n* One-click alternatives: Hostinger offers Docker Catalog one-click for Hermes (great for testing), but Hetzner gives more control.\n* Migration from OpenClaw: `hermes claw migrate` (seamless).\n\n**Cost Breakdown (Typical):**\n\n* VPS: €5–10/month (Hetzner)\n* LLM API (OpenRouter/etc.): $5–20/month (depends on usage)\n* Total: Usually under $30/month for heavy daily use.\n\nTroubleshooting\n\n* Command not found? `source ~/.bashrc`\n* Gateway issues? `hermes doctor` and check logs.\n* API rate limits? Switch models or add credits.\n* Still stuck? Run `hermes --help` or check the official docs.\n\nYou now have a persistent, self-improving AI teammate living on a €5 VPS that you can chat with from anywhere. Deploy it once, and it just keeps getting better.  \n  \nDrop your first command to Hermes and watch the magic happen.\n\nDisclaimer: I have no affiliation with Nous Research, Hetzner, OpenRouter, or any of the mentioned tools/providers. It's purely informational; always do your own testing and security review before deploying anything on a VPS.","offTopic":false},{"id":"159f3fa9-393b-41e6-bcfa-bf5973906928","excerpt":"Easiest way to setup Hermes agent for beginners — \\*Just being honest, this post contains affiliate links (see rule 4).\n\nHey guys, here's a simple beginners guide for setting up for Hermes agent.\n\n**TL;DR** \\- There’s hosting providers that will pre-install Hermes and manage server security for you in a sandboxed envir","url":"https://www.reddit.com/r/HostingHostel/comments/1vulqiy/easiest_way_to_setup_hermes_agent_for_beginners/","role":"request","weight":0.8380819,"occurredAt":"2026-08-21T16:49:32.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"HostingHostel","intent":"feature_request","painScore":0.17139384,"sentiment":0.57894737,"confidence":0.71545696,"matchedPatterns":["recommend","missing_feature"],"statement":"You get a managed sandbox environment that’s secure, easy to set-up, and beginner friendly, but the VPS lacks sudo access necessary for more advanced workflows.","title":"Easiest way to setup Hermes agent for beginners","body":"\\*Just being honest, this post contains affiliate links (see rule 4).\n\nHey guys, here's a simple beginners guide for setting up for Hermes agent.\n\n**TL;DR** \\- There’s hosting providers that will pre-install Hermes and manage server security for you in a sandboxed environment. IMO this is the easiest way for beginners to get started with Hermes and run it 24/7 since you don’t have to worry about server security updates and the initial server provisioning to set up Hermes securely.\n\nFor context, I’m currently running Hermes agent on [Cloudways Managed AI Agents](https://hostingadmiral.com/go/agent-platform?data1=hermes-ez26) platform.\n\nI’ve been withholding from running agentic workflows with Hermes for awhile, primarily because I’ve been too lazy to properly provision a VPS to be secure enough to trust. \n\nBut since Cloudways pre-installs Hermes and manages server security for me, I’ve been trying out Hermes and was able to create a useful set-up allowing Hermes to control my calendar.\n\nNow I can add/edit Google Calendar events from WhatsApp. I also installed `git` and `Github`, so I can get status updates on PR requests, issues straight from my phone.\n\nThe downside is that **you don’t have full root/sudo access** but this is probably fine if you’re just doing API orchestration or running user-scoped scripts, but not ideal if you’re looking to install Tailscale or Docker to run advanced development workflows.\n\nAnyways to get started, [sign up](https://hostingadmiral.com/go/agent-platform?data1=hermes-ez26) for Cloudways' Managed AI Platform. You can use the promo code `AGENT` for a 30% discount. I also have a basic set-up tutorial, just scroll down below to the `How to Setup` section.\n\nhttps://preview.redd.it/kxw39kakbrkh1.png?width=1500&format=png&auto=webp&s=fbf35f61603099d03ff7fb2a482bd9f517bbec4f\n\n**Cloudways agent platform is best for:**\n\n* External API orchestration (IE: connecting to Gmail/Google Workspace)\n* Running Hermes as an ordinary user\n* User-local binaries and Python/Node tools\n* Git workflows\n* User-scoped scripts/services\n\nHowever, since Cloudways currently doesn’t give you root/sudo access or broader permissions, it is not suitable for advanced developer workflows like:\n\n* Docker or Docker Compose on the host\n* `systemd` services\n* Tailscale or other VPNs requiring /dev/net/tun\n* KVM/QEMU workloads\n* FUSE mounts\n* Host-level reverse proxies, firewalls, or daemons\n* Packages requiring system-wide installation\n\nSo this is the fundamental trade-off. You get a managed sandbox environment that’s secure, easy to set-up, and beginner friendly, but the VPS lacks sudo access necessary for more advanced workflows.\n\nKeep in mind that you can still install user-specific applications in your home directory. For example, I was able to set up 1Password and Git/GitHub CLI because they do not inherently require system-wide access. However, applications that require root privileges, system services, or kernel-level capabilities are currently not possible. Installing and running Tailscale, for example, requires networking capabilities that are restricted in the platform environment.\n\nThat being said, I think this is definitely a good option for Hermes beginners who are just looking to get started without having to worry about Linux server provisioning.\n\n**The technical parts you still need to understand is:**\n\n1. **How to generate an API key from your preferred AI provider.** In order for Hermes agent to work, you’ll need to provide an API key from your preferred AI provider. I have model recommendations listed below.\n2. **How to generate API keys with permissions.** If you want to enable your agent to orchestrate aspects of your life, you’ll need to familiarize yourself with generating API keys, and specifying the scope of permissions available from said API key. For example if you wanted your Hermes agent to summarize your incoming emails every morning. This will require you to go to your email provider (Outlook/Gmail) and generate an API key with **read** access to your inbox. As a rule of thumb **Do not give your agent full access to everything**, create permission scoped environments where agent capabilities can be contained to defined operations.\n3. **How to SSH into a server.** In order to set-up API integrations (Like the email summary example above), you’ll have to be comfortable SSHing into the server to configure the server’s .env file (environment file) with API tokens you’ve generated. If this seems intimidating to you even with the help of AI walking you through the process, use an file viewer like [FileZilla](https://filezilla-project.org/) so you can visually see your servers file structure in a user-friendly GUI.\n4. **Secrets management.** As you get more into this nerdy stuff, you’ll quickly recognize that it’s impossible to keep track of all the passwords, and API tokens securely without re-using the same password for everything. **DO NOT DO THIS!** Instead use a password manager like [1Password](https://1password.com/) to keep track of everything. It will make your life so much easier.\n\n# How to Setup Cloudways AI Agents\n\nOnce you sign up you’ll need to put in billing information since the agent platform currency isn’t available in the free trial.\n\nhttps://preview.redd.it/mxa2vqzpbrkh1.png?width=1736&format=png&auto=webp&s=ef5791b99334d9e610a859f737240153f5081104\n\nOnce you add in your billing info, Cloudways (Digital Ocean) will charge you $5, (at least I got charged).\n\nBut now you should see **AI Agents** in the sidebar.\n\nhttps://preview.redd.it/4wyqlazpbrkh1.png?width=548&format=png&auto=webp&s=56af003b171f6cebbce747c39766057b9327295d\n\nClick **Get Started**, fill out your info, then select Hermes.\n\nhttps://preview.redd.it/41qvqbzpbrkh1.png?width=1586&format=png&auto=webp&s=c348fe756c7bc6db94590cd543e2244eda881420\n\nThen you’ll need to select an instance size (you can just go with Scout), then an API token from your preferred AI vendor (recommendations below).\n\nIf you want to use open-source models like GLM, DeepSeek, or Kimi, select OpenRouter (then make an OpenRouter account).\n\nhttps://preview.redd.it/fwbmtizpbrkh1.png?width=1584&format=png&auto=webp&s=f01298883a71e49b77db1a026e8ee31ffabeca0a\n\nOnce your server is up, you’ll be given access details and SSH info.\n\nhttps://preview.redd.it/we2isbzpbrkh1.png?width=1918&format=png&auto=webp&s=089829e31aef3fd27c69af57e952730caaa752e0\n\nhttps://preview.redd.it/ma71gazpbrkh1.jpg?width=1024&format=pjpg&auto=webp&s=4fec4b095953f5c7b5e451b66b1f56ac05088d86\n\nhttps://preview.redd.it/2w84aqzpbrkh1.jpg?width=1024&format=pjpg&auto=webp&s=8d3fb282c82387ab6fed4b45b14f1d1906802ed2\n\n# Recommended AI models to use for Hermes agent\n\nObviously, this is a subjective question but in general you’re looking for the cheapest model possible with the highest intelligence. Here’e what I recommend but please keep that the AI space moves super quick so at the time of you reading this, these suggestions will likely be out-dated.\n\n|**Company**|**Model**|**Why**|\n|:-|:-|:-|\n|OpenAI|GPT-5.6-Luna-Max|OpenAI is the company that makes ChatGPT. Their *Luna* model series is their most intelligent *cheap* model. This is currently the model I’m using for my Hermes agent.|\n|Anthropic|Sonnet 5|Anthropic is the company that makes Claude. Similar to OpenAI/Luna, Anthropic's Sonnet series is their most intelligent *cheap* model.|\n|Moonshot|Kimi K3|Chinese open source model, highly intelligent and cheap!|\n|DeepSeek|DeepSeek-V4|Another Chinese open source model. It has currently one of the highest intelligence to cost ratios so highly recommend this if you’re looking to save $$$ on API costs.|\n\nAnyways, that’s my quick set-up guide. Feel free to comment down below if you have any questions…\n\n  \nWhat do you guys think of all this? Do you think we’ll start seeing more *managed hosting options* for AI agent layers like Hermes and Open Claw?","offTopic":true}],"breakdown":[{"sourceKey":"reddit","sourceName":"Reddit","count":4}],"total":4}}