How to Run Your Own AI Agent on a VPS (with Synced Storage)

What You're Building

Enlarge

Architecture

You end up with:

• Hermes Agent running 24/7 on a VPS with persistent sessions and memory.
• Tailscale providing a private encrypted mesh, no public ports exposed.
• Syncthing keeping a folder synced bidirectionally between your PC and the VPS.
• WebUI accessible from your browser via the Tailscale IP.

Shopping List

Enlarge

Shop list items

Step 1: Provision a Hetzner VPS

1. Go to hetzner.com/cloud and create an account
2. Click Create Server and pick CX22 (sweet spot for Hermes)
3. Location: pick the closest data center to you
4. Image: Ubuntu 24.04 LTS
5. SSH key: add your public key (or you'll get a root password via email)
6. Click Create & Buy Now

Enlarge

hetzner page

Once provisioned, note the public IP. SSH in:

ssh root@<your-public-ip>

Initial housekeeping:

apt update && apt upgrade -y
apt install -y curl wget git ufw

Step 2: Install Hermes Agent

Hermes Agent is an open-source AI agent framework by Nous Research. You can install it with the Hermes Desktop Installer on macOS or Windows (recommended).

For a command-line-only install, run:

Linux / macOS / WSL2 / Android (Termux)

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

If you change your mind and want to install & run Hermes Desktop after a command-line-only install, simply run:

hermes desktop

After installation, reload your shell and start chatting::

source ~/.bashrc   # or: source ~/.zshrc
hermes             # Start chatting!

To reconfigure individual settings later, use the dedicated commands:

hermes model          # Choose your LLM provider and model
hermes tools          # Configure which tools are enabled
hermes gateway setup  # Set up messaging platforms
hermes config set     # Set individual config values
hermes setup          # Or run the full setup wizard to configure everything at once

What is Hermes Agent? It's an autonomous AI agent that can use tools — run shell commands, read/write files, search the web, delegate subtasks, and more. It works with any LLM provider (OpenRouter, Anthropic, OpenAI, DeepSeek, and 15+ others). It has persistent memory across sessions and can self-improve by saving reusable procedures as "skills."

Step 3: Configure Your AI Provider

Hermes works with 20+ providers. Here are the most common:

Option A: OpenRouter (easiest — one key, many models)

hermes model

Select OpenRouter, then paste your API key from openrouter.ai/keys.

Or set it manually:

hermes config set model.provider openrouter
echo "OPENROUTER_API_KEY=sk-or-v1-..." >> ~/.hermes/.env

Option B: DeepSeek (cheap, excellent coding)

hermes config set model.provider deepseek
echo "DEEPSEEK_API_KEY=sk-..." >> ~/.hermes/.env

Option C: Anthropic (Claude)

hermes config set model.provider anthropic
echo "ANTHROPIC_API_KEY=sk-ant-..." >> ~/.hermes/.env

Try it out:

hermes chat -m "openrouter/anthropic/claude-sonnet-4" -q "Explain quantum computing in one paragraph"

Step 4: Set Up Tailscale

Tailscale creates a private WireGuard mesh between all your devices. Every device gets a stable 100.x.y.z IP address, reachable only by your other Tailscale devices.

On the VPS

curl -fsSL https://tailscale.com/install.sh | sh

#After ionstallation completes, start the Tailscale client
tailscale up --ssh --accept-routes

Here's what each part does:

• tailscale up: Brings the Tailscale client online and connects it to your tailnet. If the device isn't authenticated yet, it may prompt you to log in. Visit the URL it prints, authenticate with Google/GitHub/Microsoft, and you're done.
• --ssh: Enables Tailscale SSH on this device. This allows you to SSH into the machine using Tailscale's built-in SSH feature without needing to manage traditional SSH keys (provided your tailnet's SSH policies allow it).
• --accept-routes: Tells this device to accept routes advertised by other Tailscale nodes. This is commonly used when another machine on your tailnet is configured as a subnet router or exit node. Without this flag, your device ignores those advertised routes.

Verify:

#To display the Tailscale IPv4 and IPv6 addresses for your device, run:
tailscale ip

#Check the connection status:
tailscale status

You should see your VPS with a 100.x.y.z address.

On Your Local Machine

Install Tailscale from tailscale.com/download — it's a one-click install on Windows, macOS, or Linux. Log in with the same account.

You should now see both devices:

100.92.x.x hermes-agent linux -

100.75.x.x my-laptop windows -

You can now SSH from your local machine using the Tailscale IP:

ssh root@100.92.x.x

No port forwarding, no public SSH exposure, no key management — Tailscale handles it all.

Once Tailscale is confirmed operational, drop all public ingress traffic except for the handshake channels:

ufw default deny incoming
ufw default allow outgoing
ufw allow in on tailscale0
ufw enable

Step 5: Install Syncthing

Syncthing is an open-source continuous file synchronization tool. It's like Dropbox, but peer-to-peer with no cloud storage in the middle.

On the VPS

# Add repo
curl -fsSL https://syncthing.net/release-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/syncthing-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable" | sudo tee /etc/apt/sources.list.d/syncthing.list

# 1. Install Syncthing
sudo apt-get update && sudo apt-get install -y syncthing xmlstarlet

# 2. Force run and immediately kill to safely generate default config.xml
syncthing --generate="/root/.config/syncthing"

CONFIG_PATH="/root/.config/syncthing/config.xml"
TAILSCALE_IP=$(tailscale ip -4)

# 3. Use xmlstarlet to cleanly update bind addresses to Tailscale interface only
xmlstarlet ed -L \
  -u "/configuration/gui/address" -v "127.0.0.1:8384" \
  -u "/configuration/options/listenAddress" -v "tcp://$TAILSCALE_IP:22000" \
  $CONFIG_PATH

# 4. Remove default folder structural block
xmlstarlet ed -L -d "/configuration/folder[@id='default']" $CONFIG_PATH

# 5. Enable and launch systemd service
sudo systemctl enable --now syncthing@root

Verify it's only listening on Tailscale:

ss -tlnp | grep syncthing

# Should show: 100.x.y.z:22000 (Tailscale IP only)
# 127.0.0.1:8384 (web UI, localhost only)

On Your Local Machine

• Windows: Download SyncTrayzor (tray app + Syncthing bundled)
• macOS: brew install syncthing or download from syncthing.net

Linux: Same apt install as the VPS

Step 6: Create the Shared Folder

On the VPS

# Extract validated API Key
APIKEY=$(xmlstarlet sel -t -v "/configuration/gui/apikey" /root/.config/syncthing/config.xml)
BASE="http://127.0.0.1:8384/rest"
VPS_ID=$(syncthing --device-id)
LOCAL_ID="YOUR_LOCAL_DEVICE_ID" # <-- Paste your local machine ID here

# 1. Register the local device into the VPS instance database first
curl -s -X PUT -H "X-API-Key: $APIKEY" -H "Content-Type: application/json" \
  "$BASE/config/devices/$LOCAL_ID" \
  -d "{
    \"deviceID\": \"$LOCAL_ID\",
    \"name\": \"local-developer-box\",
    \"addresses\": [\"dynamic\"],
    \"compression\": \"metadata\"
  }"

# 2. Create the shared directory structure on disk
mkdir -p /home/shared
chmod 755 /home/shared

# 3. Provision the folder layout mapping both known devices
curl -s -X PUT -H "X-API-Key: $APIKEY" -H "Content-Type: application/json" \
  "$BASE/config/folders/shared" \
  -d "{
    \"id\": \"shared\",
    \"label\": \"Shared Agent Assets\",
    \"path\": \"/home/shared\",
    \"type\": \"sendreceive\",
    \"devices\": [
      {\"deviceID\": \"$VPS_ID\"},
      {\"deviceID\": \"$LOCAL_ID\"}
    ],
    \"rescanIntervalS\": 30
  }"

# 4. Commit and restart daemon to bind configuration state
curl -s -X POST -H "X-API-Key: $APIKEY" "$BASE/system/restart"

Step 7: Connect Your Local Machine

Find your local device ID

Open the Syncthing web UI at http://127.0.0.1:8384, go to Actions → Show ID. Copy the full device ID string.

Add the VPS as a remote device

1. In your local Syncthing UI, click "Add Remote Device"
2. Paste the VPS device ID
3. Under Addresses, change from dynamic to a static address:
   1. tcp://100.92.x.x:22000 (use your actual VPS Tailscale IP)
4. Click "Save."

Accept the shared folder

After the devices pair, you'll see a notification: "hermes-agent wants to share folder 'shared'."

Click "Add," pick a local folder path (e.g., C:\Users\You\Shared on Windows or ~/Shared on macOS/Linux), and confirm.

Test the sync

On the VPS:

echo "Hello from the VPS!" > /home/shared/test.txt

Check your local folder; test.txt should appear within seconds.

Step 8: Launch the Hermes Dashboard

Hermes Agent includes a built-in web dashboard for managing configuration, API keys, and sessions from any browser.

On the VPS:

By default the dashboard binds to 127.0.0.1 localhost only. To reach it from your local machine via Tailscale, bind it to all interfaces and skip the auto-browser open on the headless server:

hermes dashboard --host 0.0.0.0 --no-open
#Access the Web UI localhost:9119

• --host 0.0.0.0 — listens on all interfaces, including the tailscale0 interface, making the dashboard reachable at your Tailscale IP.
• --no-open — suppresses the automatic browser launch (pointless on a headless VPS)

Security note: Binding to a non-loopback address requires authentication. On first access, the dashboard will present a login screen. Set up a password by running hermes dashboard register or configure an OAuth provider via the dashboard itself once it's running.

Keep it alive after SSH logout:

hermes dashboard runs in the foreground and dies when your SSH session disconnects. Use one of these approaches to make it persistent:

Option A — tmux (recommended, simplest):

# Start a detached tmux session running the dashboard
tmux new-session -d -s dashboard 'hermes dashboard --host 0.0.0.0 --no-open'

# To check on it later:
tmux attach -t dashboard

# (detach with Ctrl+B, then D)
# To stop it:
tmux kill-session -t dashboard

Option B — nohup with linger (no extra tools needed):

# Allow user processes to survive SSH logout (one-time setup)
sudo loginctl enable-linger root

# Launch dashboard in background
nohup hermes dashboard --host 0.0.0.0 --no-open > /dev/null 2>&1 &

# Verify it's running:
hermes dashboard --status

Now open your browser to http://100.92.x.x:9119 your actual VPS Tailscale IP. You can chat with Hermes from any browser, send it tasks, and it'll execute them on the VPS. The shared Syncthing folder means files dropped on either machine are instantly available everywhere.

For HTTPS (optional): Set up a reverse proxy with Caddy or Nginx + Let's Encrypt pointed at 127.0.0.1:9119. Or use Tailscale Funnel to expose the dashboard with a public URL and automatic TLS — no certificate management needed.

What Now?

Your setup is complete. Here's what you can do next:

• Chat with Hermes Agent
• Run a on-shot task/goal
• set up a Telegram bot -> hermes gateway setup
  • choose telegram in the list
  • on Telegram, chat with @BotFather to create a new bot and obtain a token
• schedule recurring tasks
• install new skills

Written with the help of Hermes Agent itself. :)