Advanced · optional · after your basics feel steady

Remote Hermes, Safely

A VPS keeps Hermes working while your laptop sleeps — scheduled jobs, messaging gateways, always-on dashboards. It also puts your assistant on a computer you rent, reachable over the internet. This page is the hardening checklist that makes that trade safe. Think of it as isolation precautions for a server: not optional, not negotiable, done before contact.

Do you even need this? Most nurses don't, or not yet. Hermes Desktop on your own computer is private by default — this whole page exists only for the always-on path. And the one rule gets stricter here, not looser: a rented server never holds PHI, private family files, or employer-confidential documents. Files on a VPS are not local-only; they are exactly as private as the server is hardened.

The rule that governs everything

Never expose Hermes or its gateway to the public internet.

This is the official Hermes guidance, and it is the whole game: Hermes should be reachable by you, from your devices — and by no one else. Everything below is just ways of keeping that true. When this page and the official security docs disagree, the official docs are the truth.

1 · Connect through a private network, not open ports

Use Tailscale (free for personal use) or a VPN to link your laptop, phone, and server into a private network — a staff-only corridor between your devices. Hermes listens inside that corridor; the public internet never sees it. This one choice replaces a dozen fiddly firewall decisions and is the most nurse-friendly way to do this correctly.

2 · Lock the server's front door (SSH)

When you create the VPS: make a non-root user for daily work (root is the master key — used for setup, then put away), log in with SSH keys instead of passwords, and turn password login off. Your provider's "getting started" guide covers all three; ask your browser AI to walk you through your specific provider's screens — that's a Green-tier task.

3 · Firewall: deny by default

Allow SSH and your Tailscale/VPN connection. Deny everything else. On Ubuntu that's three lines (ufw default deny incoming · ufw allow ssh · ufw enable). If a port isn't explicitly needed, it stays closed — the same logic as a locked med room.

4 · Turn on Hermes's auth gate for anything remote

Hermes reachable beyond your own machine must require login. Bind the backend to your private network, and use the OAuth option (Nous Portal) so access is verified against your account — that's the officially supported setup for a VPS or any remote backend. No auth gate, no remote access. Ever.

5 · Allowlist every messaging door

Every channel you connect (Telegram, WhatsApp, Slack…) is a door into a tool-using AI. Official guidance: configure a caller allowlist for every network-exposed adapter — only your listed user IDs may talk to the bot, with DM pairing/approval codes on. Never enable "allow all users." The full walkthrough is the Gateway Security Checklist in your Starter Kit (11-Messaging-Team/).

6 · Contain what the agent can execute

If your remote Hermes runs commands or serves anyone besides you, use the container-isolated backends the official docs recommend (Docker or a managed sandbox). The agent's commands then run inside a sealed box, not on the host — so a bad command, or a poisoned instruction from fetched content, can't touch the server itself.

7 · Patch, back up, and treat backups as secrets

Turn on automatic security updates (Ubuntu: unattended-upgrades). Back up your workspace on a schedule — and remember a Hermes backup contains your configuration and credentials: encrypt it, and store it like the narcotics-cabinet keys, never in a shared drive or public repo.

The remote time-out — verify before you expose. Non-root user created · SSH keys only, password login off · firewall default-deny · Tailscale/VPN up and Hermes bound to it · auth gate on with OAuth · every channel allowlisted, "allow all users" off · agent commands containerized if serving others · auto-updates on · backups encrypted · no PHI, family-private, or employer files anywhere on the box. Ten checks, once — then your always-on assistant is a locked unit, not an open ward.

This tier of work is Orange under EDENA — advanced integration, deferred until you can pass the time-out above with a named owner (you) and logging in place. If any check is unclear, bring it to the Lamp Huddle before going live, not after. Related reading: the Configuration Handbook (gateway chapter), When Things Go Wrong, and the official Hermes security docs.