How to Self-Host Hermes Agent on a VPS (2026 Guide)

To self-host Hermes Agent you need a small Ubuntu VPS, Node.js and the Hermes runtime, and a model provider - either a cloud API key or a local model served through Ollama. Harden the box, run the agent as a systemd service so it survives reboots, and put nginx with TLS in front of the control UI. The whole setup fits on a $5 VPS.

Hermes Agent is a compact open-source agent runtime from Nous Research. It runs headless as a background service, pairs with any supported model, and stands out for two things: multiple layers of persistent memory that survive across sessions, and a learning loop that turns repeated tasks into reusable skills. This guide walks through a production-shaped install from a blank server to a working, always-on agent.

What do you need to self-host Hermes Agent?

Not much. Hermes Agent is MIT-licensed and runs comfortably on modest hardware:

• A VPS running Ubuntu LTS (1 vCPU and 1-2 GB RAM is plenty for the agent itself), or a spare box like a Mac Mini
• Node.js LTS and the Hermes Agent runtime
• A model provider - a cloud API key, or Ollama with a small local model if you want everything offline
• A domain or subdomain if you want to expose the control UI over HTTPS

If you run models locally, size the machine for the model rather than the agent. A small 3B to 8B model wants 8 GB of RAM or more, so a common pattern is to keep the agent on a cheap VPS and point it at a cloud API, then move to local Ollama later.

Step 1: Provision and harden a VPS

Create an Ubuntu LTS server with any provider (DigitalOcean, Hetzner, Vultr, or a spare machine at home). SSH in and do the security basics first - never run the agent as root on an unhardened box.

Create a non-root user and give it sudo:

adduser hermes
usermod -aG sudo hermes

Copy your SSH key to the new user, then lock down SSH in /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes

Restart SSH, then enable a firewall that allows only what you need:

sudo systemctl restart ssh
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP (Let's Encrypt)
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

These are the same hardening steps we cover in depth in the OpenClaw security guide - firewall rules, fail2ban, and key-only SSH apply equally to a self-hosted Hermes Agent.

Step 2: Install Node.js and the Hermes runtime

Install Node.js LTS from the NodeSource repository so you get a current, supported version:

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version

Then install the Hermes Agent runtime and confirm it launches. Depending on how the release is packaged you either install it globally with npm or clone the repository and install dependencies:

# Option A: package install
sudo npm install -g hermes-agent

# Option B: from source
cd /opt
sudo git clone https://github.com/NousResearch/hermes-agent.git
sudo chown -R $USER:$USER /opt/hermes-agent
cd /opt/hermes-agent
npm install

Run the binary once with --help or its init command to confirm it works before turning it into a service. Check the project’s README for the exact command names in your version - they change faster than this guide does.

Step 3: Install Ollama and pull a model (optional)

If you want a fully local, no-API-key setup, install Ollama and pull a small model:

curl -fsSL https://ollama.com/install.sh | sh
ollama pull hermes4:8b   # or a small Llama / Qwen variant

Here is where Hermes Agent earns its keep. It auto-detects models installed through Ollama and ships per-model tool-call parsers, so function calling is tuned for each local model without you touching a config. It pairs especially well with Nous Research’s own Hermes 4 open-weight models, which are strong at tool calling, but any supported model works. For a deeper comparison of which models perform best, see best local models for OpenClaw and Hermes Agent.

Step 4: Configure the model provider and keys

Hermes Agent reads its provider settings and secrets from environment variables. Keep them in a file the service reads, not in your shell history.

For a local Ollama setup:

# /opt/hermes-agent/.env
HERMES_PROVIDER=ollama
OLLAMA_HOST=http://127.0.0.1:11434
HERMES_MODEL=hermes4:8b

For a cloud provider, drop the Ollama lines and set your API key instead:

HERMES_PROVIDER=openai
OPENAI_API_KEY=sk-your-key-here
HERMES_MODEL=gpt-4o-mini

Lock the file down so only your user can read it:

chmod 600 /opt/hermes-agent/.env

Step 5: Run Hermes Agent as a systemd service

A process manager keeps Hermes Agent running after reboots and restarts it if it crashes. On Ubuntu, systemd is already there - create a unit file at /etc/systemd/system/hermes.service:

[Unit]
Description=Hermes Agent
After=network.target

[Service]
Type=simple
User=hermes
WorkingDirectory=/opt/hermes-agent
EnvironmentFile=/opt/hermes-agent/.env
ExecStart=/usr/bin/node /opt/hermes-agent/bin/hermes start
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start it:

sudo systemctl daemon-reload
sudo systemctl enable --now hermes
sudo systemctl status hermes

You should see active (running). Follow the logs live with:

journalctl -u hermes -f

Bind the control UI to 127.0.0.1 in your config so it is never exposed directly - nginx will handle public access in the next step.

Step 6: Add an nginx reverse proxy with TLS

Point a subdomain such as agent.yourdomain.com at your VPS IP, then put nginx in front of the local control UI and secure it with a free Let’s Encrypt certificate.

sudo apt-get install -y nginx certbot python3-certbot-nginx

Create a site config at /etc/nginx/sites-available/hermes (adjust the port to whatever your agent’s UI listens on locally):

server {
    listen 80;
    server_name agent.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable it and issue the certificate:

sudo ln -s /etc/nginx/sites-available/hermes /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d agent.yourdomain.com

Certbot configures HTTPS and sets up auto-renewal. The full reverse-proxy pattern, including HTTP-to-HTTPS redirects and WebSocket handling, is covered in our nginx reverse proxy guide - it applies to Hermes Agent unchanged.

Step 7: Verify persistent memory and the learning loop

This is the part that makes Hermes Agent worth self-hosting. Give the agent a task, then restart the service and confirm it remembers.

sudo systemctl restart hermes

Ask it about something from the earlier session. Thanks to its multiple layers of persistent memory, the agent should recall prior context rather than starting fresh. Over time the learning loop turns tasks you repeat into reusable skills, so the agent gets faster at the work you actually do. If memory does not persist, check that your data directory is on disk (not a tmpfs) and that the service user can write to it.

How does this compare to OpenClaw?

If you have already read how to install OpenClaw on a VPS, the shape here is familiar: provision, harden, install, run as a service, proxy with TLS. The difference is what the agent does once it is up. OpenClaw is built around messaging channels; Hermes Agent leans into headless automation with memory and learned skills. We break down the trade-offs in OpenClaw vs Hermes Agent if you are still deciding which to run.

Let us handle the install

Standing up a hardened, always-on self-hosted Hermes Agent is very doable, but the details - firewall rules, systemd units, TLS, and getting persistent memory writing to the right place - are exactly where DIY installs go wrong. We do this every day. We will install Hermes Agent for you, configured with security best practices from the start, and our maintenance and monitoring service keeps it patched and online so you can just use the agent, not babysit it.