How I Deploy a Hermes Agent on a Blank VPS in 2 Minutes

I just rented a fresh VPS — a blank Debian server. No Docker. No firewall. No agent. I needed Hermes running on it fast, and I did not want to SSH in and type 50 commands by hand. So I built a tool that does it for me.

hermes-bootstrap is an open-source CLI + Web UI that provisions a Hermes Agent VPS from zero to production in one go. It handles everything: swap, packages, Docker, SSH hardening, UFW, Fail2Ban, Telegram alerts, and the agent itself. Open source, MIT licensed — github.com/swingkiddo/hermes_bootstrap.

pip install git+https://github.com/swingkiddo/hermes_bootstrap.git

Step 1 — Start the dashboard

One command opens a web UI at localhost:8080. No messing with config files.

hermes-bootstrap serve

Step 2 — Fill the form

The UI has a clean, step-by-step sidebar. Here is what I filled in:

• Connection — VPS IP + root password. The server was fresh out of the box, no SSH keys yet.
• LLM Provider — OpenRouter + API key.
• Telegram — bot token to send commands to the agent and get replies.
• Security — SSH hardening (port 2091, root login disabled), Firewall (UFW deny-by-default), and Fail2Ban for brute-force protection.
• Notifications — a Telegram hook that alerts me every time someone SSHs into the server.

Important — do not lock yourself out. If you do not check "Permit Root Login", root access is gone after deployment, and port 22 stops working too — the tool moves SSH to your configured port (default 2091). Remember both your new port and your hermes user password. Locking yourself out is surprisingly easy to do.

On the bright side: after a successful deployment, the tool automatically writes a ~/.ssh/config entry on your local machine. So you do not have to remember the new port or username — just ssh <server-name> and you are in.

Step 3 — Click Deploy

I hit Deploy and watched the live log stream. The tool SSHs into the server and runs 8 steps in order:

System → User → SSHD → Firewall → Fail2Ban → Hermes → Notify → Verify

If any step fails, it rolls back automatically — no orphaned configs left behind.

Step 4 — Done

Two minutes later the server is fully hardened:

• SSH on port 2091 (non-default)
• UFW firewall active, deny-by-default
• Fail2Ban protecting against brute force
• Hermes Agent running in a hardened Docker container — all caps dropped, no-new-privileges
• A Telegram message every time someone SSHs into the box

Bonus: multi-server dashboard

You can manage multiple VPSes from one dashboard. Each server has its own config, SSH keys, and deploy history — useful when you run agents across different providers.

Try it

The tool is open source and MIT licensed. Install it in one line and point it at your VPS:

pip install git+https://github.com/swingkiddo/hermes_bootstrap.git
hermes-bootstrap serve

Source: write-up by koocha_mala. Tool: swingkiddo/hermes_bootstrap.

</content>