Wiki · Integrations
Hosting and domains
The agent needs somewhere to run around the clock — but not an expensive server. A practical operations guide.
Three options
| Your computer | VPS (rented server) | Home server | |
|---|---|---|---|
| Always on | No — it sleeps with the machine | Yes | Yes, while power and internet last |
| Public address | No | Yes, immediately | Only via a tunnel or a public IP |
| Cost | 0 | A few euros a month | Electricity + hardware |
| Best for | Trying it out, working with local files | Normal operation, webhooks, cron | Those who do not want their data at a provider |
How big a server
| Load | Sensible minimum |
|---|---|
| One agent, Telegram, cron, a few skills | 2 cores, 4 GB RAM, 40 GB disk |
| Multiple profiles, a small local model | 4 cores, 8–16 GB RAM |
| A local model for the main work | A strong GPU or rented GPU time — otherwise stay with a cloud model |
Disks fill up faster than expected — sessions, logs, backups, images. Watch
df -h and set up cleanup of old files before you run out of space.
Domain and DNS
You need a domain for two reasons: webhooks (GitHub, Twilio and WhatsApp Cloud all want a public HTTPS address) and a pleasant way in to the agent's web UI. One domain and a subdomain is enough.
| Step | Why |
|---|---|
| A subdomain for the agent, not the whole domain | Keep the main domain for your site; if the agent breaks, the site stays up |
| Low TTL (300 s) during setup | Changes take minutes, not an hour |
| Raise the TTL once it works | Fewer DNS queries |
HTTPS
If you would rather not manage nginx, Caddy obtains certificates by itself. For webhooks from the internet HTTPS is mandatory — without it GitHub and Twilio will not deliver anything.
On a machine with no public address (home computer) a temporary tunnel is enough:
cloudflared tunnel --url http://localhost:8080. The address changes, so it is for testing;
for permanent operation use a named tunnel or a VPS.
Server security
| Measure | How |
|---|---|
| Key-only SSH | PasswordAuthentication no in /etc/ssh/sshd_config |
| Firewall | ufw allow 22,80,443/tcp then ufw enable; everything else closed |
| Updates | unattended-upgrades — security patches apply themselves |
| The agent is not root over everything | Its own user, channel allowlists, confirmations for dangerous commands |
| Gateway as a service | hermes gateway install — survives logout and reboot |
Backups and monitoring
Keep a copy of ~/.hermes off the server (not on the same disk) and verify a restore
actually works. For monitoring, let the agent watch itself — see the measurement and monitoring page.
How we do it
| Habit | Why it paid off |
|---|---|
| One small VPS for the agent, websites elsewhere | When the agent experiments, sites keep serving |
An agent. subdomain with HTTPS | Webhooks work and the address is memorable |
| A nightly backup off the server | Recovering from a bad update takes minutes |
| Watching disk space | The most common reason something stops working |
For concrete hosting offers see the Hosting page; prices move, which is why we do not copy them here.