Hermes Agent on Hetzner: the real steps, from new server to a gateway that stays up

Choose a server size from what you will run

Hermes does not publish a minimum for a bare install. Its Docker guide gives the best documented figures: 1 GB of memory is enough without browser tools, at least 2 GB is advised with them, and 2 to 4 GB is recommended. The same guide calls browser automation the most memory-hungry feature. Those are container numbers, so read them as a guide rather than a guarantee. The system requirements guide goes through what drives memory, and covers local models, which are a different sizing problem and not a fit for the small plans below.

The practical reading: if the agent only chats through a cloud model, a 2 GB machine can work; if you want the browser, several chat channels, scheduled jobs or more than one profile, start at 4 GB. The installer sets up the browser tools by default (an agent browser and its own Chromium), so you pay the memory and disk for them unless you skip them in the next section. You can also move up later: Hetzner says you can change a server’s performance at any time with its Rescale option.

Plans below are from the Hetzner Cloud plan pages on 2 November 2026. Prices are the “from” monthly figures in euros, excluding VAT. The page marked the four Cost-Optimized plans as not available that day, so what you can order may differ.

Hetzner describes the Cost-Optimized line as older processor generations suited to light and test workloads, and the Regular Performance line as newer hardware. On those pages the EU locations were Falkenstein, Nuremberg and Helsinki, with Singapore as an extra region on the Regular Performance plans. Hermes lists Linux on both x86_64 and aarch64 as supported, so an Arm plan is an option, though we have not tested one for this guide. Disk is rarely the limit: the Hermes Docker guide suggests 2 GB or more for the data volume, which every plan above exceeds.

Create the server, then lock it down

In the Hetzner Console, open your project, go to Servers and choose Add server. Pick a location, an image, the plan, networking, an SSH key, and optionally a Firewall, Backups and a name. Hermes tests on the latest Ubuntu and says a distribution with glibc and systemd that follows the usual Linux file layout is likely to work, so a current Ubuntu LTS image is the safe choice. Two details from Hetzner’s own documentation matter:

• Add your SSH key here. Hetzner says that once the server exists you can no longer add an SSH key through the Console. Paste your public key during creation, and do not rely on a password.
• Backups are a paid option set at creation or later. They are automatic daily copies of the disk with seven slots; check the price in the info box on hetzner.com/cloud before ticking it. More on what they do and do not cover below.

A non-root user. Log in once as root and create the account Hermes will run under. Hermes keeps everything in that user’s home, and running the installer as root would put the data in root’s home instead.

adduser hermes
usermod -aG sudo hermes
mkdir -p /home/hermes/.ssh
cp /root/.ssh/authorized_keys /home/hermes/.ssh/authorized_keys
chown -R hermes:hermes /home/hermes/.ssh
chmod 700 /home/hermes/.ssh
chmod 600 /home/hermes/.ssh/authorized_keys

Open a second terminal and confirm ssh hermes@your-server-ip works and that sudo -v succeeds, before you close the root session. Then turn off root login and passwords by setting PermitRootLogin no and PasswordAuthentication no in a file under /etc/ssh/sshd_config.d/ and reloading the SSH service.

The Hetzner Cloud Firewall. Create one under Firewalls and apply it to the server (you can add the server later, or use label selectors). Hetzner’s documentation states the rules that matter: new inbound traffic is dropped unless a rule allows it, replies to connections the server started are allowed automatically because the firewall is stateful, and with no outbound rules all outbound traffic is allowed, but the moment you add one outbound rule everything else outbound is dropped. Cloud Firewalls are free.

So the rule set for a chat-app agent is short. Add one inbound rule: TCP port 22 from your own IP address, and nothing else. Leave the outbound list empty. Telegram, Discord and the WhatsApp QR bridge reach out from the server rather than being called, and Hermes opens a Telegram webhook port or other webhook receivers only if you enable those. The dashboard on 9119 and the API server on 8642 are the two to keep closed; the Hermes Agent ports guide lists each port and how to reach the dashboard safely, for example with an SSH tunnel such as ssh -L 9119:localhost:9119 hermes@your-server-ip. If your home IP changes, edit the rule in the Console.

Install Hermes with the official installer

Connect as the new user and run the installer from the Hermes documentation:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

The script clones the source, prepares Python, Node.js and other tools itself, and puts a hermes launcher in ~/.local/bin, with your data in ~/.hermes. On Debian and Ubuntu it may ask for your sudo password once, to install a system library Node.js needs. It also installs the browser tools by default; to leave them out and save memory and disk, pipe it with bash -s -- --skip-browser, and add them later with hermes pm install agent-browser. A new install lands on the latest stable release.

Then reload the shell and finish setup:

source ~/.bashrc
hermes model
hermes doctor

hermes model picks your provider and model; hermes doctor reports config and dependency problems. Start hermes once and send a message to prove the model answers before you involve a chat app.

Run the gateway as a service that survives logout and reboot

The gateway is the process that keeps your chat apps and scheduled jobs alive. Run in a terminal, it dies when the SSH session closes. On Linux Hermes installs it as a systemd service:

hermes gateway install
hermes gateway start
hermes gateway status

By default this is a user service, and a user service stops at logout unless systemd keeps that user’s session alive, which is called lingering. The install step tries to turn it on for you and prints that linger is enabled. If it cannot (permissions are the usual reason), do it yourself once:

sudo loginctl enable-linger $USER

hermes gateway status prints a line saying whether linger is enabled and warns that the gateway may stop at logout when it is not. Logs are in journalctl --user -u hermes-gateway -f.

There is a second route: sudo hermes gateway install --system installs a boot-time system service that still runs as your user. The Hermes documentation suggests the user service plus linger for a headless VM, because a system service needs root for every restart, including the automatic one at the end of hermes update. Do not keep both installed at once; Hermes warns if it finds both.

Prove it rather than assume it: run sudo reboot, log back in a minute later and check hermes gateway status. A gateway that is running without you having logged in first is the result you want.

Connect a chat app, update, and back up

Chat channel. hermes gateway setup walks through the messaging platforms. Each has its own steps and, more importantly, its own rules for who may talk to the agent, which on a public server matters because the agent can run commands and read files. Follow the Hermes Agent guide for your app, for example Telegram, WhatsApp or Discord, and restart the gateway with hermes gateway restart after changing settings.

Updates. A source install updates itself:

hermes update

It follows the stable channel, so it moves from one published release to the next. By default it attempts a snapshot of state files first, then applies the new code, prepares dependencies, runs config migration and restarts gateways that were running. On Linux, gateways normally pause just before the code changes and resume after the dependencies are ready. hermes update --check reports whether a newer release exists without applying it. Run it as the same user that installed Hermes.

Backups. Your data directory ~/.hermes holds config, keys, sessions, skills and scheduled jobs. Hermes has its own command:

hermes backup -o ~/backups/hermes.zip

It is safe while Hermes runs, leaves out the program code, and also leaves out browser profiles, so a restored agent has to log in to sites again. It exits with an error status if the archive is incomplete, which a cron job can notice. Schedule it, and copy the zip off the server, because a copy on the same disk dies with the disk.

Hetzner’s paid Backups are a different layer: daily copies of the whole server disk, seven kept, with the oldest replaced automatically. Snapshots are the manual version and are kept until you delete them. Neither includes attached Volumes. They are useful for rebuilding the machine, but a Hermes export is easier to move to another host, so many people keep both.

What you now maintain, and the common failures

Running it yourself means the whole stack is yours: operating-system security updates on the server, Hermes updates, the firewall and SSH keys, backups that you have actually tested by restoring, the billing and limits of your model provider, and noticing when the agent has gone quiet. Nobody alerts you by default; a chat bot that is down looks the same as a bot with nothing to say.

• The agent stops answering after you log out. Linger is off. Run sudo loginctl enable-linger $USER, then hermes gateway restart.
• The install step says it cannot reach the user systemd session. Hermes reports that systemctl --user cannot reach the user D-Bus. Enable linger as above; if the socket still does not appear, log out and back in, or reboot.
• hermes is not found after installing. Reload the shell with source ~/.bashrc, or log in again, so ~/.local/bin is on the path.
• You are locked out of SSH. The Cloud Firewall dropped you: your IP changed, or the rule was never added. Edit the Firewall in the Console.
• The process dies or the server crawls. Usually memory, often browser tools. Check the kernel log for out-of-memory kills, skip or limit the browser, or use Hetzner’s Rescale to a larger plan.
• The gateway restarts in a loop. Hermes warns against adding a systemd drop-in that kills the process after every stop, such as an ExecStopPost line. Remove it.
• hermes update leaves the gateway down. With a system service, a non-root update tries passwordless sudo. If that is not available, it prints a manual sudo systemctl restart command instead. The user service plus linger avoids this.

Doing this yourself or using a hosted agent

A Hetzner server suits you if you like owning the machine, want the files and keys on a server you control, plan to run other things next to the agent, or want to learn how it works. It gives the most freedom, and the freedom comes with the list above: it is your job to keep it patched, backed up, reachable and sized correctly, and you find out about problems when a message goes unanswered.

A hosted agent suits you if you want the assistant itself rather than the hosting of it, and would rather not spend an evening on SSH, firewalls and systemd or the occasional night fixing one. The trade is less control over the machine. The self-hosting versus managed hosting guide sets the two out side by side. Neither is the wrong choice; they answer different questions.

Hermes Agent hosting on ReadyHermes

ReadyHermes runs a Hermes Agent for you, so the steps above (sizing, the non-root user, the firewall, the service, updates) are handled on our side. A new assistant is ready in about 10 seconds, and you use it from a browser workspace. The same assistant can answer in Telegram, WhatsApp, Discord, WeChat or Lark. Changes that restart the assistant, such as connecting a channel, take about a minute.

The free trial lasts one hour. You can use your own model provider key in the trial and on paid plans, and a key added during the trial stays when you choose a plan. When the trial ends the assistant pauses, and it is deleted unless you choose a plan within 24 hours. If what you want is a machine of your own to log in to and configure, the Hetzner route above is the one that gives you that. For what a hosted plan includes, see managed Hermes Agent hosting.