This walkthrough is for Hermes Agent by Nous Research running on a Fluence CPU Cloud virtual server. It does not cover hosting a local LLM model on the VM.
Hermes Agent itself is lightweight; the LLM calls usually go to an external model provider such as OpenRouter, Anthropic, OpenAI-compatible endpoints, Hugging Face, DeepSeek, Gemini, or another provider configured through Hermes. Hermes lists provider setup through hermes model, provider API keys in ~/.hermes/.env, and custom endpoints in config.yaml.
What this guide covers
By the end, you will have:
- A Fluence VM running Linux.
- Hermes Agent installed on that VM.
- A configured LLM provider.
- A verified Hermes CLI chat session.
- An optional always-on Hermes messaging gateway running as a Linux service.
- A secure way to access the Hermes web dashboard through an SSH tunnel, without exposing the dashboard publicly.
Before you start
You need:
- A Fluence account with Console access and enough balance to rent a VM, where it’s paid from your Balance, and CPU Cloud reserves two days of rent when an instance is deployed.
- An SSH key pair on your laptop. Fluence lets you manage SSH keys from the Settings page, and when renting an instance you must provide at least one public SSH key.
- A model-provider login or API key. For Hermes agent server/VPS setup, an API-key provider such as OpenRouter, Anthropic, DeepSeek, Hugging Face, Gemini, or another OpenAI-compatible endpoint is usually the simplest path.
- A Mac, Linux, or Windows laptop with a terminal. On Windows, use PowerShell, Windows Terminal, or WSL for the SSH commands.
Step 1: Add funds to your Fluence balance
Open Fluence Console and go to the Billing page. Then:
- Click Top Up.
- Enter the amount you want to add.
- Complete the CopperX payment flow.
- Return to Fluence Console and wait until the payment status becomes Completed.
Fluence’s docs explain that VM rent is charged from the Balance smart contract, and the Billing page is where top-ups are initiated. The docs also state that a CPU Cloud instance deducts two days of rent at deployment: one day charged immediately and one day kept as reserve.
Step 2: Create an SSH key on your laptop
If you already have an SSH key you want to use, you can skip the key-generation command and use your existing public key.
On your laptop, run this first to make sure your .ssh folder exists:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
Then, run this command to create the SSH key:
ssh-keygen -t ed25519 -C “fluence-hermes” -f ~/.ssh/fluence_hermes_ed25519
Then print the public key:
cat ~/.ssh/fluence_hermes_ed25519.pub
Copy the full output. It should start with something like:
ssh-ed25519 AAAA…
Paste that into Fluence Console under Settings → SSH Keys.
In Fluence Console:
- Open Settings.
- Go to SSH Keys.
- Add a new SSH key.
- Paste your public key.
- Save it.
Fluence supports RSA, ECDSA, and ED25519 SSH key formats. ED25519 is a good default for a new key.
Step 3: Create the VM in Fluence Console
In Fluence Console, open Public Cloud and go to Compute / CPU Cloud.
Create a new instance and use this sequence:
- Choose a data center location.
- Choose a CPU/RAM configuration. Fluence CPU Cloud resources are allocated in multiples of a compute unit: 2 vCPUs and 4 GB RAM. For a basic Hermes Agent gateway, the smallest available CPU configuration is a reasonable starting point unless you expect heavy browser automation or many users.
- Choose storage. Storage starts at a minimum of 25 GB.
- Choose the server type.
- Rent a public IPv4 address. A public IPv4 address is currently the way to access the instance over SSH.
- Set the instance name, for example:
hermes-agent-fluence
- Set open ports. Keep the default port 22 open for SSH. Do not open dashboard ports publicly. Only port 22 is open by default, and additional ports can be assigned if needed.
- Choose a Linux OS image. If an Ubuntu LTS image is available, choose it so the commands below match the VM environment.
- Select or paste your public SSH key.
- Review the summary and price.
- Launch the instance.
After launch, wait until the VM status becomes Active and copy its public IP address. Fluence defines Active as the instance status where the VM is running and accessible.
Step 4: Connect to the VM over SSH
From your laptop terminal, run:
ssh ubuntu@YOUR_VM_PUBLIC_IP
Replace YOUR_VM_PUBLIC_IP with the IP address shown in Fluence Console.
If your Fluence image uses a different default username, replace ubuntu with that username.
The first time you connect, SSH may ask whether you trust the host fingerprint. Type:
yes
Once connected, your terminal prompt changes and you are inside the Fluence VM.
Step 5: Update the VM and install the base dependency
Inside the VM, run:
sudo apt update && sudo apt upgrade -y
sudo apt install -y curl ca-certificates git
Hermes’ official installer says the only prerequisite is Git; it automatically handles uv, Python 3.11, Node.js 22, ripgrep, ffmpeg, the repo clone, virtual environment, global hermes command setup, and provider configuration. Installing curl, certificates, and Git first makes the installer path clean on a fresh Ubuntu VM.
Confirm Git is available:
git –version
Step 6: Install Hermes Agent
Run the official Linux installer as your normal VM user, not with sudo:
curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash
This is the Linux/macOS/WSL2 quick install command. The normal per-user layout puts the Hermes code under ~/.hermes/hermes-agent/, creates a ~/.local/bin/hermes command, and keeps data/config under ~/.hermes/.
After the installer finishes, Hermes will ask:
For an easier process, choose “Quick setup” and follow the instructions.
Step 7: Choose Quick Setup or Full Setup
After the installer finishes, Hermes may immediately launch an interactive setup flow.
You will see a choice similar to:
Quick setup
Full setup
Choose:
Quick setup
Use Quick setup for the initial Fluence VPS deployment. It gets the core Hermes setup working: model provider, API key, model choice, terminal backend, and basic working-directory configuration.
Use Full setup only when you want to configure more Hermes features immediately.
Hermes’ installation docs say the installer handles dependencies, the repo clone, virtual environment, the global hermes command, and LLM provider configuration. They also list hermes setup as the full setup wizard and hermes model as the dedicated provider/model configuration command.
Step 8: Configure the model provider
During Quick setup, Hermes asks you to choose a model provider.
For this Fluence VPS guide, choose:
OpenRouter
Then paste your OpenRouter API key when prompted.
After that, select the model you want to use. In your current setup, you selected:
qwen/qwen3.6-35b-a3b
Hermes supports OpenRouter through the OPENROUTER_API_KEY variable, and its environment-variable reference describes OpenRouter as a flexible provider option.
When this step succeeds, Hermes shows something like:
Default model set to: qwen/qwen3.6-35b-a3b (via OpenRouter)
That means your LLM provider setup worked.
Step 9: Choose the terminal backend
Next, Hermes asks:
Select terminal backend:
For a basic Hermes deployment on a Fluence VPS, choose:
Local – run directly on this machine
In this context, Local means the Fluence VPS, not your MacBook.
Hermes’ configuration docs say the terminal backend determines where the agent’s shell commands execute. Supported backends include local machine, Docker, SSH, Modal, Daytona, Vercel Sandbox, and Singularity/Apptainer.
For your current setup:
Choose Local
This is the simplest correct choice for installation and initial testing.
For a later production gateway deployment, Docker is safer because it isolates agent-executed commands from the host VPS. Hermes’ security docs recommend docker, modal, daytona, or vercel_sandbox for production gateway deployments.
Step 10: Set the Gateway working directory
After choosing the terminal backend, Hermes asks:
Gateway working directory [.]:
For the initial Fluence VPS setup, press:
Enter
This accepts the default:
.
That means Hermes gateway and cron sessions will use the current working directory as their starting directory.
This setting affects gateway sessions such as Telegram, Discord, and cron jobs. It does not control normal CLI chat sessions. Hermes’ config example states that terminal.cwd is the gateway/cron working directory, while the CLI always uses the launch directory.
Step 11: Finish the setup wizard
Continue answering any remaining setup prompts using the defaults unless you have a specific reason to change them.
When setup finishes, you should return to the normal server shell prompt:
ubuntu@…:~$
Now reload your shell:
source ~/.bashrc
Then verify Hermes is available:
which hermes
hermes version
hermes doctor
Hermes’ installation docs recommend reloading the shell after installation and using hermes doctor for diagnostics when something is missing.
Step 12: Test Hermes in CLI mode
Start Hermes:
hermes
Send a test prompt:
Confirm Hermes is installed, tell me the active model, and tell me which directory you are running from.
A successful reply means:
- Hermes is installed
- OpenRouter is configured
- The selected model is reachable
- The local terminal backend is working
Exit with:
Ctrl+C
Then test session resume:
hermes –continue
Hermes’ quickstart says the fastest path is to set up Hermes, run a real chat, and verify it responds before moving on to gateway or always-on use.
Step 13: Configure the messaging gateway only after CLI works
Do not treat the terminal backend screen as the gateway setup.
They are different:
- Terminal backend: where Hermes executes shell commands
- Gateway: background service for Telegram, Discord, Slack, cron, browser, etc.
After CLI chat works, configure the gateway:
hermes gateway setup
Hermes’ messaging docs describe the gateway as a single background process that connects to configured platforms, handles sessions, runs cron jobs, and delivers voice messages.
Then test it in the foreground:
hermes gateway
Stop it with:
Ctrl+C
Step 14: Install the Hermes gateway as a system service on the Fluence VPS
Once the foreground gateway works, install it as a system service:
HERMES_BIN=”$(command -v hermes)”
sudo “$HERMES_BIN” gateway install –system
sudo “$HERMES_BIN” gateway start –system
sudo “$HERMES_BIN” gateway status –system
Check logs:
journalctl -u hermes-gateway -f
This is the always-on deployment step. The earlier Quick setup flow only configured Hermes; this step makes the gateway run persistently on the Fluence VPS.
For your current screen, the immediate next action is simply:
Press Enter
Then wait for setup to finish and test with:
hermes
Step 14: Recommended security settings
Keep only SSH open on the Fluence VM unless your chosen messaging platform specifically requires an inbound callback/webhook port. Fluence opens port 22 by default and lets you add more ports, but the dashboard workflow above does not require exposing dashboard ports. (Fluence Docs)
Use allowlists or pairing for messaging access. Do not set:
GATEWAY_ALLOW_ALL_USERS=true
Hermes explicitly warns against allowing all users on a bot with terminal access. (Hermes Agent)
For production-style deployments, use sandboxing for agent terminal commands. Hermes recommends docker, modal, daytona, or vercel_sandbox backends for production gateway deployments so agent commands are isolated from the host system. (Hermes Agent)
Hermes stores its configuration, API secrets, OAuth data, memories, skills, sessions, and logs under ~/.hermes/. Back this directory up if the server matters to you. (Hermes Agent)
A simple backup command is:
tar -czf hermes-backup-$(date +%F).tgz ~/.hermes
Step 15: Updating Hermes
To update Hermes later, run:
hermes update
Then validate:
hermes doctor
hermes version
sudo “$HERMES_BIN” gateway status –system
Hermes’ update docs say hermes update pulls the latest code, updates dependencies, prompts for new config options, and refreshes running gateways. The docs also recommend checking config, version, and gateway status after updates. (Hermes Agent)
Troubleshooting
If SSH does not connect, check that the Fluence instance is Active, that a public IPv4 address is attached, that port 22 is open, and that the right SSH public key was added during VM creation. Fluence docs define Active as running/access, public IPv4 as the SSH access path, and public SSH key selection as part of the instance creation flow. (Fluence Docs)
If hermes says command not found, reload the shell and check the install path:
source ~/.bashrc
which hermes
ls ~/.local/bin/hermes
Hermes’ troubleshooting docs say this usually means the shell has not reloaded the updated PATH. (Hermes Agent)
If Hermes opens but replies fail, run:
hermes model
hermes doctor
Hermes’ quickstart says broken replies are usually provider auth or model-selection problems, and recommends running hermes model again. (Hermes Agent)
If the gateway starts but nobody can message it, run:
hermes gateway setup
sudo “$HERMES_BIN” gateway status –system
journalctl -u hermes-gateway -f
Hermes’ quickstart points to bot token, allowlist, or platform setup issues when the gateway starts but messages do not work. (Hermes Agent)
If the dashboard does not load, confirm all three are true:
- The dashboard is running on the VM.
- The SSH tunnel is still open on your laptop.
- You are visiting http://127.0.0.1:9119 on your laptop, not the VM’s public IP.
The dashboard is designed to run locally on 127.0.0.1:9119, and the secure Fluence pattern is to tunnel that localhost service over SSH instead of exposing it publicly. (Hermes Agent)
Summary
You now have:
- A Fluence CPU Cloud VM.
- SSH access to the VM.
- Hermes Agent installed with the official Nous Research installer.
- A configured LLM provider.
- A verified Hermes terminal session.
- An optional messaging gateway deployed as a Linux system service.
- A secure dashboard access pattern using SSH tunneling.
This gives you a clean base deployment for running Hermes Agent on an always-on Fluence virtual server while keeping the dashboard private and the messaging gateway controlled through allowlists or pairing.
