Hermes Bot Infrastructure

Hermes Agent (Nous Research) running on a Hetzner Ubuntu VPS (4GB RAM). Quick reference for what’s set up.

Core

  • Provider: OpenRouter → deepseek/deepseek-v4-flash
  • Auxiliary vision: google/gemini-2.5-flash via OpenRouter
  • Personality: kawaii

Credentials

  • API keys stored in Bitwarden Secrets Manager (3 secrets: GitLab token, Gmail app password, SERPAPI key)
  • OpenRouter key in ~/.hermes/.env
  • Secret redaction enabled by default

Gateway

  • Telegram only — systemd service, auto-starts on boot

Web UI

  • URL: admin.riginski.org
  • Systemd service (hermes-webui.service) — Python bootstrap on port 8787
  • Cloudflare tunnel (Quick Tunnel, token-based) + Cloudflare Access with Google Auth — fully configured

Webhooks

  • endpoint: webhook.riginski.org → port 8644
  • vault-deploy — GitLab CI success → Telegram notification
  • vault-deploy-failed — GitLab CI failure → auto-diagnose + fix + push

Vault CI/CD

  • GitLab → Quartz v5 → Cloudflare Pages → riginski.org
  • Cached builds (~20-30s on cache hit)
  • Auth: Google login (David + Molly)

Email

  • hermes.daverigie@gmail.com via Himalaya CLI (IMAP/SMTP)

TTS

  • Edge TTS, voice: en-GB-RyanNeural

Cron Jobs

  • Daily briefing (8am PT) — weather + commute
  • Afternoon commute (4:30pm PT) — San Carlos → Alameda traffic
  • Vault cleanup audit (daily)

Key Conventions

  • Never force push
  • Auto-commit + push vault edits (unless review needed)
  • Config changes via hermes config set (file is protected)
  • Secrets never read into LLM context
  • Web UI: admin.riginski.org
  • Webhook: https://webhook.riginski.org/
  • GitLab: daverigie/hermes-vault

See Also

Graph View

Backlinks