Running Hermes 24/7 on dedicated hardware

July 21, 2026 · View on GitHub

A practical, vendor-neutral guide to running Hermes Agent around the clock on a machine you leave on — a Raspberry Pi, a mini PC, a NUC, or any always-on Linux box.

Hermes itself is easy to install. The part that trips people up is everything around it: keeping the agent up after a crash or a power cut, and not losing its memory when something goes wrong. This guide focuses on those two problems — staying up and not losing state — because they're what separate a demo from an agent you actually rely on.

Maintained by the MangoTart team. MangoTart ships a small computer with Hermes, backups, a dashboard and recovery already wired up (see the last section) — but everything here works on any hardware you own, and nothing in this guide requires MangoTart.

Why dedicated, always-on hardware?

You can run Hermes on your laptop or a $5 VPS. Both work. A dedicated box you leave on is worth it when you hit one of these:

  • Your laptop sleeps. An agent that watches prices twice a day or replies to your inbox needs to be awake at 3am. A laptop lid-down isn't.
  • Datacenter IPs get blocked. A lot of the web (retail, banking, social, ticketing) treats VPS/ datacenter IP ranges as bots and blocks or CAPTCHA-walls them. A machine on your home connection browses from a residential IP, signed in where you're signed in.
  • You want the memory local. Hermes keeps what it learns about you as files. On your own box those files stay on your desk — you can read, edit, back up, and move them yourself.

Tradeoff, honestly: a small box is not a workstation. It's sized for an agent that works in short bursts around the clock, not for training models or heavy parallel jobs. That's the right tradeoff for this job, but know it going in.

1. Baseline

Any always-on Linux machine works. A common, cheap, low-power choice is a Raspberry Pi 5 (8 GB) with an NVMe SSD, but a mini PC or an old laptop-turned-server is fine too.

  1. Install a 64-bit Linux (Raspberry Pi OS 64-bit, Debian, or Ubuntu Server).
  2. Install Hermes with the official installer (it sets up uv, Python, Node, ripgrep, ffmpeg): 
    curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
  3. Run hermes setup once to pick your model provider (hermes model) — a ChatGPT plan, OpenRouter, any API key, or a local endpoint. Hermes is provider-agnostic, so this guide doesn't assume one.

On Linux/macOS, Hermes keeps its state in ~/.hermes by default (memory, skills, config, chat history). The rest of this guide refers to it as $HERMES_HOME — confirm the path on your own install:

export HERMES_HOME="$HOME/.hermes"

2. Keep it running (systemd)

Run Hermes as a systemd service so it starts on boot and restarts if it dies. See examples/hermes.service:

[Unit]
Description=Hermes Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=hermes
WorkingDirectory=%h
# `hermes gateway` runs the always-on messaging gateway (Telegram, Discord, etc.).
# Use the absolute path from `which hermes` — the installer usually drops it in ~/.local/bin.
ExecStart=%h/.local/bin/hermes gateway
Restart=always
RestartSec=5
# don't hammer restarts if it's crash-looping
StartLimitIntervalSec=300
StartLimitBurst=5

[Install]
WantedBy=multi-user.target

sudo cp examples/hermes.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now hermes
systemctl status hermes

3. Survive a power cut

An always-on box will lose power eventually. Make sure it comes back on its own:

  • Auto power-on after outage. On a mini PC/NUC, enable "Restore on AC Power Loss" (or "After Power Failure: Power On") in the BIOS. A Pi powers on whenever it gets power, so just make sure it's on a circuit that comes back.
  • Boot straight into the service. systemctl enable (above) already handles this.
  • Optional: hardware watchdog. Many boards (including the Pi) expose a hardware watchdog that reboots the machine if the kernel hangs. Enable it via systemd (RuntimeWatchdogSec in /etc/systemd/system.conf) for an extra safety net on truly stuck states.
  • Use a journaling filesystem (ext4/xfs — the default on the distros above) so an abrupt power loss doesn't corrupt state mid-write.

4. Back up what matters

The whole point of a persistent agent is that it remembers. So the thing you must protect is $HERMES_HOME — memory, learned skills, config, and chat history. Back it up encrypted, on a schedule, and off the box.

This guide uses age for encryption because it's tiny and transparent. The companion skill repo, hermes-backup-recovery, packages ready-to-run backup / verify / restore / healthcheck scripts — use those rather than copy-pasting your own.

Schedule a daily backup with a systemd timer (see examples/):

# nightly at 03:30, calling the skill's backup.sh
sudo systemctl enable --now hermes-backup.timer

Keep at least one copy off the box — another machine, a NAS, or object storage. A backup that only lives on the same SSD as the original doesn't survive the SSD dying.

5. Prove you can restore

A backup you've never restored is a guess, not a backup. Once a month, run a restore drill into a scratch directory and confirm the files come back:

# from the hermes-backup-recovery skill:
BACKUP_DIR=/backups AGE_IDENTITY=~/age/keys.txt ./scripts/verify.sh
RESTORE_TARGET=/tmp/restore-drill ./scripts/restore.sh --apply /backups/hermes-<timestamp>.tar.gz.age

If verify.sh passes and the drill directory has your data, you're covered.

6. Health checks

Catch problems before they become outages. Run a one-shot health check on a timer (service up, disk not full, last backup recent) and have it ping you if something's wrong. The skill repo's healthcheck.sh does exactly this and exits non-zero when attention is needed — wire that into a systemd timer + a notification (email, Telegram, ntfy, whatever you use).

7. Security basics

  • Keep it on your LAN. You don't need to expose Hermes to the public internet. Reach it over your home network or a private tunnel (Tailscale/WireGuard). Don't port-forward it.
  • Secrets in env/files, not in the repo. API keys, age keys, and provider tokens belong in root-only files (chmod 600), never committed anywhere.
  • Separate user. Run Hermes as its own unix user, not root, so a bad browsing session can't touch the rest of the box.

Don't want to wire all this up? (turnkey option)

Everything above is doable on hardware you already own — that's the point of this guide. If you'd rather skip the setup, MangoTart is a small always-on computer that ships with Hermes, a real browser, a local dashboard, encrypted daily backups, and recovery already configured — plug in power + network, scan a QR code, done. One-time purchase, bring your own model, no subscription. It's one option, not a requirement; the guide stands on its own.

License

MIT — use, adapt, and share freely.

Contributing

Corrections and additions welcome, especially real-world notes from running Hermes on different boards. Open an issue or PR.