Hermes Agent Production Deployment: VPS Docker Guide

Deploy Hermes Agent to production on a $12/month VPS by installing with pip, configuring Docker terminal backend, setting up the Telegram gateway, and enabling cron scheduling. The agent runs as a systemd service with auto-restart. Total infrastructure cost: under $15/month plus API token usage.

The deployment pattern that the Hermes community has converged on: a single VPS running Hermes as a systemd service with Docker backend, MCP servers, and messaging gateway. No Kubernetes. No orchestration framework. One machine, one agent, always on.

Start with a DigitalOcean or Hetzner $12/month VPS. Ubuntu 22.04, 2GB RAM, 50GB SSD. Install Hermes with pip install hermes-agent. Run hermes setup for the interactive wizard. The wizard configures the model provider, creates the default profile, and tests the connection.

[TOOL: Hermes Terminal Backend] Configure the Docker backend for isolated command execution: hermes config set terminal_backend docker. The Docker image should include curl, jq, python3, and any tools your workflows need. Never run Hermes with the local terminal backend on a production VPS — a prompt injection could execute arbitrary commands on the host.

[TOOL: Hermes Gateway] Set up Telegram first. Talk to @BotFather to get a BOT_TOKEN. Run hermes gateway setup and paste the token. The gateway uses polling by default, which works through NAT and firewalls without open ports. Test by sending /start to your bot.

The security model is layered. Docker backend provides container isolation. Command approval gates block dangerous operations. The pre_tool_call hook can veto any tool execution based on regex patterns. For highly sensitive production access, run Hermes in a separate VPC with no public inbound access.

[STAT: Production Hermes deployments average $15/month infrastructure + $150-350/month API costs for teams of 3-5 (Source: Hermes Community Deployment Survey, 2026)]

Cron jobs are configured in natural language: hermes cron add Check health endpoints every 5 minutes. The cron scheduler lives inside Hermes and does not require system cron. Each cron job runs in its own session context with isolated tool access.

MCP servers extend capabilities. Install the GitHub MCP for code operations, Tavily for web search, Sentry for error monitoring. Configure each in hermes config set mcp_servers.. Limit to 3-5 MCP servers per profile to keep tool-selection quality high.

Production hardening checklist: enable Docker backend, set up daily state.db backups to S3, configure the on_session_start hook to check disk space, set a monthly API budget cap, enable audit logging, and create a read-only monitoring profile that can observe but not modify production systems.

The deployment survives reboots, network interruptions, and model API outages. Hermes auto-reconnects to the gateway and resumes interrupted tasks. The SQLite state database is crash-safe with WAL mode enabled.