Self-host Hermes Agent

On your computer (pick another name if my-hermes-agent is taken):

ssh exe.dev new --name=my-hermes-agent
ssh my-hermes-agent.exe.xyz

All remaining installation commands run on the VM, as exedev.

Install Hermes#

The official installer brings its own Python, Node.js, and a headless browser, and follows stable releases. A server has no desktop for the computer-use driver to control, so skip that:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh |
  bash -s -- --non-interactive --skip-computer-use
export PATH="$HOME/.local/bin:$PATH"
hermes --version

Expect Hermes Agent v0.22 or later. It takes a couple of minutes.

Connect Claude through exe.dev#

The API key below is a placeholder; exe.dev supplies the real credentials outside the VM. The /anthropic path tells Hermes to speak Claude's own API. The exe-dev provider reaches the integration's other models:

hermes config set model.provider anthropic
hermes config set model.base_url https://llm.int.exe.xyz/anthropic
hermes config set model.default claude-sonnet-5-5
hermes config set ANTHROPIC_API_KEY exe-llm-integration
hermes config set providers.exe-dev.api https://llm.int.exe.xyz/v1
hermes config set providers.exe-dev.api_key exe-llm-integration
hermes config set providers.exe-dev.transport chat_completions
hermes -z "Reply with exactly: pong"

The agent should answer pong.

Start the gateway#

The gateway connects chat apps and runs scheduled jobs. Lingering keeps your services running after you log out:

sudo loginctl enable-linger "$USER"
hermes gateway install
loginctl show-user "$USER" -p Linger
systemctl --user is-enabled hermes-gateway
systemctl --user is-active hermes-gateway

Expect Linger=yes, enabled, and active. With no chat app yet, its log says No messaging platforms enabled; that's fine.

Run the dashboard#

The dashboard listens only on the VM. Told its public address, it insists on a sign-in, so generate a password; it lands in ~/.hermes/.env, which only you can read:

hermes config set dashboard.public_url "https://$(hostname).exe.xyz"
hermes config set HERMES_DASHBOARD_BASIC_AUTH_USERNAME hermes
grep -q '^HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=' ~/.hermes/.env ||
  hermes config set HERMES_DASHBOARD_BASIC_AUTH_PASSWORD "$(openssl rand -hex 12)"
grep -q '^HERMES_DASHBOARD_BASIC_AUTH_SECRET=' ~/.hermes/.env ||
  hermes config set HERMES_DASHBOARD_BASIC_AUTH_SECRET "$(openssl rand -base64 32)"

The secret signs sign-in sessions, so they survive restarts. Now run the dashboard as a service:

mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/hermes-dashboard.service <<'EOF'
[Unit]
Description=Hermes Agent dashboard
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
WorkingDirectory=%h
Restart=always
RestartSec=10
RestartPreventExitStatus=78

[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now hermes-dashboard
sleep 5
curl -fsS --retry 20 --retry-connrefused --retry-delay 3 \
  http://127.0.0.1:9119/api/status | jq '.auth_required, .auth_providers'

Expect true and ["basic"].

Set up the dashboard proxy#

The exe.dev proxy handles HTTPS and login. nginx passes requests to the dashboard, keeping the browser's hostname. This replaces the image's default site:

sudo tee /etc/nginx/sites-available/hermes-agent >/dev/null <<'EOF'
map $http_upgrade $hermes_connection {
    default upgrade;
    ""      close;
}
server {
    listen 8000 default_server;
    listen [::]:8000 default_server;
    server_name _;
    location / {
        proxy_pass http://127.0.0.1:9119;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $hermes_connection;
        proxy_set_header Host $host;
        # Overwrite, never append, client attribution.
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_read_timeout 1d;
        proxy_send_timeout 1d;
        proxy_buffering off;
        client_max_body_size 50m;
    }
}
EOF
sudo rm -f /etc/nginx/sites-enabled/default
sudo ln -sf /etc/nginx/sites-available/hermes-agent /etc/nginx/sites-enabled/hermes-agent
sudo nginx -t && sudo systemctl enable --now nginx && sudo systemctl reload nginx
curl -fsS -H "Host: $(hostname).exe.xyz" http://127.0.0.1:8000/api/status |
  jq '.auth_required, .auth_providers'

Expect true and ["basic"] through nginx, too.

Set up nightly backups#

Hermes's own backup copies everything but the code and caches. Keep two weeks of private archives:

mkdir -p ~/.config/systemd/user ~/backups/hermes
chmod 700 ~/backups ~/backups/hermes
cat > ~/.config/systemd/user/hermes-backup.service <<'EOF'
[Unit]
Description=Hermes Agent backup

[Service]
Type=oneshot
UMask=0077
ExecStart=%h/.local/bin/hermes backup --output %h/backups/hermes/ --keep 14
EOF
cat > ~/.config/systemd/user/hermes-backup.timer <<'EOF'
[Unit]
Description=Nightly Hermes Agent backup

[Timer]
OnCalendar=*-*-* 03:30:00
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now hermes-backup.timer
systemctl --user start hermes-backup.service
unzip -tq "$(ls -t ~/backups/hermes/hermes-backup-*.zip | head -1)"
systemctl --user list-timers hermes-backup.timer

Look for No errors detected and a scheduled next run.

Open the dashboard#

Print your Hermes sign-in:

grep -E '^HERMES_DASHBOARD_BASIC_AUTH_(USERNAME|PASSWORD)=' ~/.hermes/.env

Open https://my-hermes-agent.exe.xyz/, sign in to exe.dev, then to Hermes, and try the chat.

On the VM, paste the token from @BotFather, then your numeric user ID from @userinfobot—not your @username:

read -rsp "Telegram bot token: " token; echo
hermes config set TELEGRAM_BOT_TOKEN "$token"
unset token
read -rp "Your Telegram user ID: " telegram_id
hermes config set TELEGRAM_ALLOWED_USERS "$telegram_id"
hermes config set TELEGRAM_HOME_CHANNEL "$telegram_id"
unset telegram_id
systemctl --user restart hermes-gateway
sleep 20
systemctl --user is-active hermes-gateway
grep -i telegram ~/.hermes/logs/gateway.log | tail -n 3

Expect active and ✓ telegram connected. Only the allowed user gets answers; the home channel is where scheduled jobs report. Message your bot to check. Groups need more settings; see Hermes's Telegram guide.

On the VM, take a fresh backup:

(umask 077; hermes backup --output ~/backups/hermes/ --keep 14)

To restore, replace BACKUP.zip with your chosen archive's filename. The import overwrites the matching files in ~/.hermes, so stop Hermes first:

systemctl --user stop hermes-gateway hermes-dashboard &&
hermes import --force ~/backups/hermes/BACKUP.zip &&
hermes config set dashboard.public_url "https://$(hostname).exe.xyz" &&
systemctl --user start hermes-gateway hermes-dashboard &&
hermes -z "What do you remember about me?"

The archive brings back its own dashboard password and bot tokens. Moving to a new VM? Set it up first, copy the archive over with scp, then restore. Stop the old VM's gateway: a Telegram bot answers only one.

On the VM, back up, then update to the latest stable release. Hermes restarts the gateway and dashboard itself:

(umask 077; hermes backup --output ~/backups/hermes/ --keep 14) &&
hermes update --yes &&
hermes --version &&
systemctl --user is-active hermes-gateway hermes-dashboard

Expect the new version and active twice. Reload the dashboard and try a chat. Your settings and memory stay put.

Ask Shelley, or check on the VM:

systemctl --user is-active hermes-gateway hermes-dashboard
journalctl --user -u hermes-gateway -u hermes-dashboard -n 40 --no-pager
hermes -z "Reply with exactly: pong"

• hermes: command not found? Run source ~/.bashrc, or log in again.
• 502 from the dashboard? It takes a few seconds to start; reload. Still there? Look for errors in the log above.
• Invalid Host header or a sign-in loop? The dashboard's public address must match the VM's; rerun the dashboard.public_url line above and restart hermes-dashboard.
• Gateway stopped after adding Telegram? A rejected bot token stops it, and scheduled jobs with it. Set a fresh token from @BotFather, or hermes config unset TELEGRAM_BOT_TOKEN, then restart hermes-gateway.
• Bot ignores you? TELEGRAM_ALLOWED_USERS must hold your numeric ID.
• No model reply? Check hermes config get model against the settings above and your LLM integration.
• hermes doctor says the Anthropic key is invalid? It tests the placeholder against Anthropic directly. If pong comes back, ignore it, and don't let hermes setup replace the model settings.