Hermes Agent Guide

Hermes Agent on DigitalOcean: A Worked Droplet Setup

Q: What size Droplet do I need for Hermes Agent?

A basic Droplet is usually sufficient because inference runs at the model provider and the gateway mostly waits on network calls. Local model hosting is a separate GPU requirement.

Q: Why should I add swap on a small Droplet?

Installation spikes memory usage well above steady state on small Droplets, so a modest swap file prevents install failures. Steady-state gateway usage is usually comfortable.

Q: Do I need to open any inbound ports?

Usually only SSH. Chat platform and model provider connections are outbound. Inbound rules are needed only for specific features such as a webhook listener.

Q: Does the installer set up a service?

Yes. On an Ubuntu Droplet the installer offers a systemd service for the gateway, which is needed because the gateway exits on a wedge expecting a supervisor to restart it.

A Droplet is a fine home for the Hermes gateway, and the setup is short. The parts worth slowing down for are the ones specific to small VPS instances — memory during install, what actually needs to be open in the firewall, and making sure something restarts the gateway when it exits.

Picking a Droplet

Start with the requirement rather than the plan list. The gateway is a Python process that mostly waits on network calls, because inference runs at your model provider. That makes a basic Droplet adequate for a personal or small-team agent.

Choose Ubuntu LTS unless you have a reason not to — it keeps you on the well-trodden path for both the Hermes installer and systemd. Pick a region close to you for SSH responsiveness; the agent's own latency is dominated by the model provider, not the Droplet.

Scale up only for a real reason: many concurrent conversations, heavy local tooling, or running models on the box. That last one is a different exercise, needing GPU resources rather than a larger Droplet.

Add swap before installing

This is the DigitalOcean-specific step most worth doing. On the smallest plans, the install is the memory-hungry moment — dependency resolution and any package that compiles will spike well above what the gateway later uses at rest. Without headroom, the install fails in a way that looks like a Hermes problem and is not.

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Swap converts an out-of-memory failure into a slower install, which is the trade you want here. It is insurance for the install spike, not a substitute for adequate RAM.

Install Hermes

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

The installer provisions its own supported Python rather than using the system interpreter, so you do not need to prepare one. See the installation guide for the general flow.

When it offers a systemd service, take it. On Ubuntu systemctl is present, so this is the default path — and it is the piece that makes the deployment real, for the reason in the next section.

Why the service is the point

The Hermes gateway runs a liveness watchdog that hard-exits when its event loop wedges, on the assumption that a supervisor will restart it. On a Droplet with a systemd service that assumption holds and the agent recovers by itself. Run it in a terminal or a tmux pane instead and the same mechanism becomes a silent outage — the full reasoning is in Hermes Agent in tmux.

A service also means the gateway comes back after a Droplet reboot, which matters because unattended reboots do happen — kernel updates, host maintenance, the occasional forced power cycle.

Firewall

The gateway's connections are outbound: chat platforms, model providers, tools. That means the default posture is closed, with SSH the only thing you normally need inbound.

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

Open additional ports only when a specific feature requires it — a webhook listener being the common case — and prefer restricting those rules to the sending service's address ranges rather than the whole internet. A DigitalOcean Cloud Firewall can do the same job at the network layer if you would rather keep rules off the box.

Before you walk away

Confirm the service starts on boot, by rebooting once and checking rather than assuming.
Keep credentials in ~/.hermes/.env with restrictive permissions, and remember that Droplet snapshots capture them — treat a snapshot as sensitive.
Enable backups or take periodic snapshots; the agent's state lives on this disk.
Set a spend alert at your model provider before leaving an agent running unattended.
Decide how you will find out the agent has stopped answering, because nothing tells you by default.

That last point is the honest cost of self-hosting, and it is the same on any provider. If you would rather not own it, the hosting guide compares the alternatives. The same walkthrough for the other framework is OpenClaw on DigitalOcean.

Hermes Agent on DigitalOcean FAQ

What size Droplet do I need for Hermes Agent?

A basic Droplet is normally enough, because inference happens at your model provider rather than on the server. The gateway spends most of its life waiting on network calls. Add resources only if you plan to run models locally, which is a GPU question rather than a Droplet-size one.

Why should I add swap on a small Droplet?

The smallest plans have little RAM, and installs are the memory-hungry moment — dependency resolution and any package that compiles will spike usage well above steady-state. A modest swap file turns a failed install into a slow one. Steady-state gateway usage is normally comfortable.

Do I need to open any inbound ports?

Usually only SSH. The gateway's connections to chat platforms and model providers are outbound. You only need inbound rules for specific features — a webhook listener, for example — and each one should be opened deliberately rather than by default.

Does the installer set up a service?

Yes. On an Ubuntu Droplet systemctl is present, so the installer offers to install a systemd service for the gateway. Accept it — the gateway is designed to exit when it wedges so a supervisor can restart it, and without a service nothing performs that restart.