How to Connect Hermes Agent VPS to Desktop App (FREE Guide)

Connect your Hermes VPS agent to the desktop app via Tailscale and a username/password dashboard — but expect token bleed and a flaky link.

The Two Methods

Hermes' official docs list two ways to bind a remote backend: OAuth and username/password. OAuth requires the Nuki plus subscription tier; the creator is on the basic plan and got registration failed, self-hosted dashboard registration is not available for this account when they tried it. The username/password route is free but exposes the dashboard to the public internet unless you wrap it in a VPN — brute-forcing it hands over API keys, configs, and shell access. They pick Tailscale.

Setting the Dashboard Credentials

Run the HERMES_DASHBOARD_USER=admin … block from the docs. The username must be admin; the password should be strong. Generate a separate random string in a second terminal and paste it as the OIDC secret. Finish the heredoc with EOF, then chmod 600 the resulting .env so the secrets stay local.

Bind to the Tailscale IP

Get the VPS address with tailscale ip -4 and substitute the 0.0.0.0 placeholder in the hermes dashboard --bind 100.x.x.x:9191 … command. From a Windows PowerShell, ping 100.x.x.x to confirm the handshake, then in the desktop app go Settings → Gateway → Remote Gateway, paste the URL, and log in. The creator says you need desktop app version 0.16 — earlier builds only show a session token field and won't render the sign-in form.

Two Real Downsides

The sidebar still shows the local filesystem, not the VPS — you lose the SFTP view you get in Termius. And the link is unreliable: a tmux new -s hermes -d 'hermes dashboard --no-open …' session survives logout roughly 50/50, so it isn't ready for a 24/7 desktop connection.

Token Economics

TUI mode streams raw text to the LLM. The desktop app injects UI schema tokens into every prompt, diluting the budget. For terminal or coding work, stay on TUI; treat the desktop client as a local convenience, not a VPS front-end.