Hermes Agent on a VPS: Hostinger, DigitalOcean, or Vultr First-Run Setup

Hermes Agent needs a stable home. A laptop that sleeps kills cron jobs; a phone dies mid-update; a Raspberry Pi loses power when the router reboots. A small Linux VPS solves all three for the price of a takeaway coffee, and gives you public IPv4/IPv6 the moment you want a tunnel, webhook, or backend exposed.

This guide walks a fresh operator from a brand-new VPS to a working hermes chat reply — Ubuntu 22.04 or 24.04 LTS, any of Hostinger / DigitalOcean / Vultr / Hetzner. By the end you’ll have a non-root user with key-only SSH, Python 3.11+, cloudflared ready for tunneling, Hermes installed, and one verified “Reply with OK” smoke test.

Why a VPS is the right starting hardware

A VPS gives you public IPv4/IPv6, root-equivalent SSH, 24/7 uptime, and the option to put a tunnel in front. Hermes Agent’s continuous-runtime path (hermes gateway, cron jobs, gateways) maps directly to a VPS: a Linux box that boots, never sleeps, runs systemd services, and survives your laptop closing. Costs range $5-12/mo for a tier that comfortably runs Hermes + a tunnel + a small backend.

Tier-by-tier: which provider to pick

All four of the providers below can run this guide end-to-end. The choice is about geography, billing preference, and whether you need ARM (cheaper per dollar) or x86 (more familiar software).

Provider	Cheapest tier	Specs	Notes
Hostinger KVM 1	~$4.99/mo	1 vCPU, 4 GB RAM, 50 GB NVMe	Best RAM/dollar; setup wizard ships a non-root user.
DigitalOcean Basic	$6/mo (free trial credit)	1 vCPU, 1 GB RAM, 25 GB SSD	Cleanest UX/docs, easiest “add SSH key at create time.” Credit covers 1-2 months.
Vultr VC2	$5/mo	1 vCPU, 1 GB RAM, 25 GB SSD	Lots of locations, hourly billing, IPv6 included. Pick if Hostinger isn’t sold locally.
Hetzner CAX11	~$4/mo	2 vCPU, 4 GB RAM, 20 GB SSD, ARM	Best price/perf. Some locations are IPv6-only — pick Ashburn, Falkenstein, or Helsinki with IPv4 enabled.

Pick Hetzner CAX11 if you want the most compute per dollar and you’re fine with ARM. Pick DigitalOcean if you’ve never run a VPS before and want free credit to absorb mistakes. Otherwise Vultr or Hostinger are both safe defaults.

What ships with the base image

All four providers ship Ubuntu 22.04 or 24.04 LTS. The boot image contains:

• A root account with a random password (emailed or shown once) or a public key you supplied at create time.
• An optional non-root user with sudo (Hostinger does this by default; DO/Vultr create root only).
• openssh-server on port 22, firewall often permissive on private networks but locked on some providers.
• cloud-init finishing any first-boot user-data script.

Two gotchas: most control panels don’t open port 22 to a non-root user until you finish their setup wizard (SSH as root first, then promote yourself). And some Hetzner locations are IPv6-only — if your home can’t reach IPv6, pick a location with explicit IPv4.

Step 1: prep the OS

SSH in as root (or the provider-supplied user) and update:

apt update && apt -y upgrade

Create a non-root user with passwordless sudo:

adduser hermes
usermod -aG sudo hermes
echo 'hermes ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/hermes
chmod 440 /etc/sudoers.d/hermes

Generate an SSH key on your local machine (not the server) — never reuse the GitHub key:

ssh-keygen -t ed25519 -C "vps-hermes-$(date +%Y%m)" -f ~/.ssh/vps_hermes_ed25519

Install the public key, lock down root SSH, and reload:

mkdir -p /home/hermes/.ssh && \
  echo "ssh-ed25519 AAAA... vps-hermes-2026-07" > /home/hermes/.ssh/authorized_keys && \
  chown -R hermes:hermes /home/hermes/.ssh && chmod 700 /home/hermes/.ssh && chmod 600 /home/hermes/.ssh/authorized_keys && \
  sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
  sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && \
  systemctl reload ssh

Test the new login in a second terminal before you close the first. Getting locked out is a 30-minute recovery loop.

Step 2: install Python 3.11 and git

Ubuntu 22.04 ships Python 3.10 by default. Hermes v0.18.2 wants 3.11+. You can pull 3.11 from the deadsnakes PPA, or use Ubuntu 24.04 which already has 3.12. This VPS runs 3.13.5 against Hermes v0.18.2 without complaint, so anything in the 3.11-3.13 range works.

sudo apt install -y python3 python3-venv python3-pip git curl ca-certificates
python3 --version

If apt only gives you 3.10 on 22.04 and you’d rather not add a PPA, re-image as Ubuntu 24.04 and skip the version worry.

Step 3: cloudflared

Cloudflared gives you a free, no-port-forwarding tunnel out to your domain — useful the moment you want a webhook, static site, or gateway behind a tunnel instead of a public IP.

curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \
  | tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" \
  > /etc/apt/sources.list.d/cloudflared.list

sudo apt update
sudo apt install -y cloudflared
cloudflared --version

The version line should match a known release (2026.5.2 as of this writing). Skip this whole step if you don’t plan to use a tunnel — Hermes doesn’t require it.

Step 4: install Hermes Agent

The official one-liner installs the CLI, venv, and a hermes command on PATH:

curl -fsSL https://hermes-agent.nousresearch.com/install | bash

The installer asks for an install directory. /opt/hermes is the per-user convention; /usr/local/lib/hermes-agent is the system-wide path used on this VPS. It clones source, sets up the venv, and prints an install receipt. If it errors, the usual cause is missing python3-venv — install it and rerun.

Confirm it worked:

hermes --version
which hermes

You should see a version line (currently Hermes Agent v0.18.2 (2026.7.7.2)) and a which hermes path that resolves into the venv or install dir you chose.

Step 5: smoke test

The first chat is the moment of truth. If a provider is already configured (you ran hermes setup --portal or hermes model during install):

hermes chat -q 'Reply with OK'

A reply arrives in 2-5 seconds. If it doesn’t, the venv didn’t install or Python can’t import hermes_agent. Run which hermes — if the path doesn’t end in /bin/hermes inside your install dir, the shell didn’t pick up the new PATH. Open a fresh SSH session or source ~/.bashrc.

If the reply is “no provider configured,” run hermes model (interactive) or hermes setup --portal (OAuth to Nous Portal) and pick one.

Step 6: gateway (optional on day 1)

If you want Telegram (or Discord, Slack, WhatsApp) on day 1, install and start the gateway:

hermes gateway install
hermes gateway start telegram

install wires up the systemd unit so the gateway survives reboots; start telegram walks you through BotFather token + allow-list (same flow as the Telegram setup companion). Otherwise skip it — the gateway can be added later. Nothing in the rest of Hermes depends on it.

What not to do

• Don’t leave root password SSH enabled. Bots start scanning the first 60 seconds; lock root down before apt upgrade.
• Don’t pick a location without IPv4 — some Hetzner sites are IPv6-only by default. If your home can’t reach IPv6, SSH will time out.
• Don’t reuse your GitHub (or any public) SSH key. A VPS key is a separate identity you can revoke and rotate independently.
• Don’t pick a VPS <1 GB RAM. Hermes + cron + gateway drifts above 500 MB under sustained use; 1 GB is the floor.

Verification checklist

#	Command	What it proves
1	lsb_release -a	Ubuntu 22.04+ confirmed
2	python3 --version	3.11+ available
3	cloudflared --version	Cloudflared binary present
4	hermes --version	Hermes binary installed
5	hermes chat -q 'Reply with OK'	Hermes runtime alive end-to-end
6	hermes cron list	Cron store readable

If all six rows pass, the VPS is ready to be a Hermes host. From here the next layers — provider picker, gateway adapters, skills, memory, cron jobs — each have their own setup guide and can be added independently without redoing anything above.

Sources

• Hermes Agent install docs
• cloudflared install docs
• ABS companion: Hermes Agent Setup v2
• ABS companion: Cloudflare Tunnel Setup for a Static Site

Last verified: 2026-07-14 against Hermes v0.18.2 (2026.7.7.2) on this VPS.