how to host Hermes Agent for $5 VPS

Wetin Hermes Agent be

Hermes Agent na self-hosted AI agent from Nous Research, we release am for February 2026. You fit run am for your own server, and e go get persistent memory for your projects, e go write its own reusable skills as e dey work, and e go reach you through chat apps like Telegram and Discord. E no dey depend on any specific model, so you fit point am to any language model wey you like, and e light enough to run for $5 VPS, inside Docker, or over SSH.

Like any agent, its value na because e dey act for your behalf, and na why you must set am up with care. Agent wey dey remember, dey learn, and dey run tasks na standing process wey get real reach inside your server. This guide go show you how to install am the safe way, and the hardening wey dey here na the same one wey you go use for running OpenClaw safely.

The one-command install, and why you must read am first

Hermes dey install with one single command:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

E convenient, but na pattern wey you must respect. To pipe script straight from internet into shell na to run whatever dey inside that script as the user wey run am. Before you run am for real server, download am first, read am, and run am as a dedicated user instead of root:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o hermes-install.sh
less hermes-install.sh

No be say we no trust Hermes specifically. Na the habit wey dey keep any curl | bash install from quietly become the weakest link for your setup.

Give am an unprivileged user

Run Hermes as its own system account, never as root, so that bug or bad instruction no go reach the rest of the machine. Create user wey no get login shell:

sudo useradd --system --home /opt/hermes --shell /usr/sbin/nologin hermes

Install Hermes under /opt/hermes and make that account be the owner. The official installer dey install for whichever user run am, so run the script wey you download as the hermes user, for example sudo -u hermes bash hermes-install.sh, and the files go land for its home directory instead of yours. The reason na the same one for running services as an unprivileged user: the account wey the agent dey run as na the ceiling for wetin e fit damage.

Firewall the box and isolate its secrets

Hermes dey do its work by reaching out to a model and to the chat apps wey you connect, so e no need to accept inbound connections from internet. Put a default-deny firewall for front of the server:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

Watch the IPv6 firewall gap here, because if rule set only cover IPv4, e fit leave service open for IPv6. Keep the model API key and any chat tokens for file wey only hermes user fit read (mode 600), and load am into the service instead of to paste am for command line where e go land for your shell history.

Run Hermes as a hardened systemd service

Systemd unit dey keep Hermes running even after you log out and after reboot, e dey restart am if e crash, and e dey let you add kernel-level sandboxing wey go limit wetin e fit touch. Turn on NoNewPrivileges, ProtectSystem=strict, PrivateTmp, and ProtectHome so that if compromise happen, e no go spread.

Generate one hardened unit here, then copy am to /etc/systemd/system/hermes.service. The unit dey start hermes gateway, the long-running process wey dey connect your chat apps; run hermes --help after you install to confirm that command and the binary path for your version before you enable the service:

The directives, and the daemon-reload and enable --now steps, dey inside running a program as a systemd service:

sudo systemctl daemon-reload
sudo systemctl enable --now hermes

Harden the server around am

Finish by hardening the front door. Move SSH to key-only authentication and disable root login, like for SSH hardening on a VPS, so that the account wey you dey use manage the box no go easy to guess. Agent wey get persistent memory worth protecting, and the cheapest protection na to make sure say no person fit log in to the server wey e dey live on.

If you prefer to understand the machinery instead of to run packaged agent, building your own AI agent on a VPS go explain am step by step.

FAQ

I fit run Hermes Agent for cheap VPS?

Yes. Hermes design for to run for small server, and $5 VPS enough for personal, always-on agent. E dey reach out to language model and to your chat apps instead of to serve heavy traffic, so e light for resources. Give am its own user, a firewall, and a systemd service, and small VPS go handle am well.

The one-line install script safe to run?

The curl | bash install convenient, but the safe habit na to download the script and read am before you run am, and to run am as a dedicated user instead of root. That way, any piped installer from any project no go ever do more than wetin that limited account allow. Nothing here dey specific to Hermes; na good practice for every install wey get this shape.

How I go run Hermes without root?

Create dedicated system user wey no get login shell, install Hermes under directory wey that user own like /opt/hermes, and run the service as that account. If agent ever get compromise, the damage go limited to wetin that one account fit reach.

How I go keep Hermes running after I log out?

Run am as a systemd service. One unit file dey start Hermes for boot, dey restart am if e crash, and dey keep am running after your SSH session end, while systemd sandboxing options dey limit wetin the process fit touch. Generate one hardened unit with the tool above and enable am with systemctl enable --now hermes.

Hermes Agent need GPU?

No. Hermes na the agent runtime, no be the language model, so e dey run fine for small CPU-only VPS. The heavy computation dey happen wherever the model dey run, wey usually na hosted API wey you connect am to. If you also want to self-host the model for the same box, size the machine for the model instead of for Hermes itself. For CPU-only model hosting, the numbers for the Ollama guide apply.