tareek/hermes-agent-web-ui

<!-- Badges -->    

Self-hosted Hermes AI agent gateway for Hugging Face Spaces. HuggingMes runs Nous Research Hermes Agent on HuggingFace Spaces, giving you a 24/7 personal AI assistant with a management dashboard, persistent HF Dataset backup, and automatic connectivity fixes for blocked outbound traffic. HuggingMes directly wires the startup providers listed below, and it can also use Hermes providers configured through hermes model or config.yaml.

Table of Contents

• —✨ Features
• —🎥 Video Tutorial
• —🚀 Quick Start
• —🔐 Access Control
• —🤖 LLM Providers
• —📱 Telegram Setup
• —🌐 Cloudflare Proxy
• —🔍 Web Search
• —💾 Backup & Persistence
• —📦 Ephemeral Package Re-install
• —🔑 API Key Rotation
• —💓 Staying Alive
• —🔐 Security & Advanced
• —💻 Terminal Access (JupyterLab)
• —🏗️ Architecture
• —🐛 Troubleshooting
• —🌟 More Projects

✨ Features

• —🧠 Hermes Core: Runs Hermes Agent for multi-turn chat, tools, memory, and agent workflows.
• —🔐 Secure by Default: Protects the dashboard and API with a single gateway token.
• —🌐 Built-in Connectivity: Adds Cloudflare Worker proxy support for Telegram and other blocked outbound traffic.
• —📊 Dashboard: Real-time view of uptime, sync health, model, provider, and agent status at /.
• —💾 Persistent Backup: Syncs chats, config, and session data to a private HF Dataset.
• —⏰ Keep-Alive: Can provision a cron-triggered Cloudflare Worker to keep the Space awake.
• —💻 Terminal Out of the Box: JupyterLab terminal at /terminal/ auto-enabled when GATEWAY_TOKEN is set — no extra config needed.
• —🔄 Self-Healing Gateway: Gateway, dashboard, health server, and JupyterLab are all monitored and automatically restarted if they exit unexpectedly.
• —📦 Ephemeral Package Replay: Install packages from the terminal and they survive restarts — shell wrappers record apt/pip/uv/npm/hermes installs and replay them on every boot.
• —🚀 Startup Scripts: Run arbitrary bash at boot via HUGGINGMES_RUN or HUGGINGMES_APT/PIP/NPM_PACKAGES variables.
• —🔑 API Key Pool Rotation: Supply comma-separated key pools (e.g. ANTHROPIC_API_KEYS=key1,key2) and the first key is promoted automatically.
• —🤖 Broad Provider Support: Supports Hermes' native providers, direct API-key providers, OAuth providers, and custom OpenAI-compatible endpoints.

🎥 Video Tutorial

Watch a quick walkthrough on YouTube: Deploying HuggingMes on HF Spaces.

🚀 Quick Start

Step 1: Duplicate this Space


Step 2: Add Your Secrets

In your Space's Settings → Variables and secrets, add these under Secrets:

• —LLM_API_KEY - Your provider API key for direct providers.
• —LLM_MODEL - The model ID to use, such as openrouter/anthropic/claude-sonnet-4, openai/gpt-4o, or google/gemini-2.5-flash.
• —GATEWAY_TOKEN - A strong token to secure the dashboard.
• —TELEGRAM_BOT_TOKEN - Telegram bot token from BotFather.
• —TELEGRAM_ALLOWED_USERS - Comma-separated numeric Telegram user IDs.
• —HF_TOKEN - Hugging Face token with write access for backups and HF providers.
• —CLOUDFLARE_WORKERS_TOKEN - Cloudflare token for outbound proxying and keep-alive automation.

Step 3: Deploy & Run

After the Space builds, open it and click Open Hermes UI to access the agent interface.

🔐 Access Control

Hermes' built-in dashboard is wrapped by HuggingMes:

• —Dashboard: Opening /app/ requires GATEWAY_TOKEN.
• —API: Routes under /v1/* require Authorization: Bearer <GATEWAY_TOKEN>.

🤖 LLM Providers

HuggingMes supports Hermes providers in two different ways:

• —Direct startup providers: Set LLM_API_KEY and LLM_MODEL, and HuggingMes maps them during boot.
• —Hermes-native providers: Use hermes model after the Space starts, or edit config.yaml through the Hermes UI.
• —Custom OpenAI-compatible endpoints: Point Hermes at your own /v1 endpoint.

Direct startup providers

These are the providers that HuggingMes maps directly from LLM_MODEL and LLM_API_KEY at startup.

Hermes-native providers and OAuth flows

These providers are supported by Hermes and can be used in HuggingMes once the agent config is set through hermes model or config.yaml. HuggingMes does not auto-map them from LLM_MODEL at boot unless Hermes itself handles that provider.

Custom and self-hosted endpoints

HuggingMes also works with any OpenAI-compatible server. Common examples include local Ollama, LM Studio, llama.cpp / llama-server, vLLM, SGLang, LocalAI, Jan, LiteLLM, ClawRouter, Together AI, Groq, Fireworks AI, Azure OpenAI, and similar services.

Use either the Hermes model wizard or a direct config.yaml entry with a base_url, model, and optional API key. For local servers that do not require auth, leave the key empty.

Recommended provider choices

• —Just want it to work: OpenRouter or Hermes' Nous Portal.
• —Want local models: Ollama, LM Studio, llama.cpp, vLLM, or SGLang through a custom endpoint.
• —Need cloud APIs: OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Hugging Face, or any other direct provider above.
• —Need routing or fallback: Use a custom endpoint such as LiteLLM or ClawRouter.

📱 Telegram Setup

To use Hermes via Telegram:

1. 1.Create a bot via @BotFather: send /newbot, follow the prompts, and copy the bot token.
2. 2.Find your Telegram user ID with @userinfobot — send it any message and it replies with your numeric user ID.
3. 3.Add TELEGRAM_ALLOWED_USERS as a comma-separated list of those numeric user IDs to restrict access.
4. 4.Add CLOUDFLARE_WORKERS_TOKEN if you need automatic outbound proxying for Telegram API traffic.

🌐 Cloudflare Proxy

Hugging Face Spaces often block outbound calls to APIs used by Telegram and some provider backends. HuggingMes can provision a Cloudflare Worker proxy automatically when you add CLOUDFLARE_WORKERS_TOKEN.

🔍 Web Search

HuggingMes (and Hermes) runs on Hugging Face Spaces, which uses AWS cloud IPs. Google, Cloudflare, and many other sites block requests from these IP ranges as bot traffic. This means browser-based web search often fails with Captcha or 403 errors.

The fix: configure a search API provider. These services handle crawling from their own residential or trusted IPs, so your agent's search requests are never blocked.

Hermes auto-selects the backend from whichever key is present. To force a specific backend regardless of which keys are set, add HERMES_WEB_BACKEND with the backend name (e.g. tavily, firecrawl, exa, parallel, or searxng).

Browser tools and page navigation

Web search goes through the API above. Direct page navigation and browser-automation tools still use Chromium and can hit IP-based blocks. For those cases:

• —Set HTTPS_PROXY (or HTTP_PROXY/ALL_PROXY) to a residential proxy URL (format: http://user:pass@host:port). HuggingMes passes this to Chromium automatically.
• —The bundled chromium-stealth-wrapper.sh also sets --disable-blink-features=AutomationControlled to suppress the JavaScript automation marker that some sites check.

💾 Backup & Persistence (Optional)

Set HF_TOKEN with write access to enable backup. HuggingMes syncs workspace data to a private HF Dataset named huggingmes-backup every 600 seconds by default.

📦 Ephemeral Package Re-install (Optional)

Install packages in the terminal and they survive Space restarts — no extra config needed. Shell wrappers record every successful apt install, pip install, uv pip install, npm install -g, and hermes plugins install into workspace/startup.sh, which is backed up and replayed automatically on next boot.

For packages you want installed from day one (before the terminal is even opened), use the startup variables:

Example:

HUGGINGMES_RUN="""
pip install pandas matplotlib
npm install -g tsx
sudo apt-get install -y ffmpeg
"""

For scripts with complex quoting, base64-encode them:

# locally
base64 -w0 setup.sh
# HF Variable
HUGGINGMES_RUN=base64:<paste-output-here>

🔑 API Key Rotation (Optional)

Spread requests across multiple API keys to avoid rate limits. Supply a comma-separated pool — the first key is promoted to the provider's singular env var, and Hermes picks it up automatically.

ANTHROPIC_API_KEYS=sk-ant-key1,sk-ant-key2
OPENAI_API_KEYS=sk-oai-key1,sk-oai-key2
OPENROUTER_API_KEYS=sk-or-key1,sk-or-key2

Supported pool vars: OPENROUTER_API_KEYS, ANTHROPIC_API_KEYS, OPENAI_API_KEYS, GOOGLE_API_KEYS, GEMINI_API_KEYS, DEEPSEEK_API_KEYS, KIMI_API_KEYS, MINIMAX_API_KEYS, NVIDIA_API_KEYS, XAI_API_KEYS, KILOCODE_API_KEYS, GLM_API_KEYS, ARCEEAI_API_KEYS, DASHSCOPE_API_KEYS, GMI_API_KEYS, TOKENHUB_API_KEYS, FIRECRAWL_API_KEYS, TAVILY_API_KEYS, EXA_API_KEYS, PARALLEL_API_KEYS.

💓 Staying Alive

With CLOUDFLARE_WORKERS_TOKEN set, HuggingMes can create a keep-alive worker that pings the Space's /health endpoint on a schedule so the free tier stays awake longer.

🔐 Security & Advanced (Optional)

💻 Terminal Access (JupyterLab)

HuggingMes includes a JupyterLab terminal at /terminal/ for direct shell access to the container — useful for running hermes commands, inspecting files, installing packages, and debugging. Enabled by default when GATEWAY_TOKEN is set.

Setup

The terminal is on by default — no extra configuration needed. Click Open Terminal → on the dashboard, then log in with your GATEWAY_TOKEN.

To disable it, set DEV_MODE=false. To use a separate terminal password, set JUPYTER_TOKEN to a different value.

Security: JupyterLab grants full shell access to the container. The terminal will not start if no GATEWAY_TOKEN is set.

What you can do

• —Run hermes CLI commands directly
• —Browse and edit files in the workspace
• —Install Python packages with pip or uv pip
• —Check logs, inspect config, debug issues

💻 Local Development

docker compose up --build
# Dashboard: http://localhost:7861
# Hermes App: http://localhost:7861/app/

🏗️ Architecture

• —Dashboard (`/`): Real-time management and monitoring.
• —Hermes App (`/app/`): Secure proxied access to the Hermes UI.
• —*API (`/v1/`)**: Proxied OpenAI-compatible agent API.
• —Terminal (`/terminal/`): JupyterLab terminal (auto-enabled when GATEWAY_TOKEN is set; set DEV_MODE=false to disable).
• —Health Check (`/health`): Readiness probe for HF and keep-alive.
• —Sync Engine: Python background task for HF Dataset persistence.

🐛 Troubleshooting

• —Telegram bot not responding: Ensure CLOUDFLARE_WORKERS_TOKEN is set and check logs for the proxy setup step.
• —Authentication failed: Clear browser cookies or use an incognito window if GATEWAY_TOKEN changed.
• —Data not persisting: Ensure HF_TOKEN has write access.
• —Provider not showing up: If it is a Hermes-native provider, run hermes model and complete the provider-specific setup there. If it is a custom endpoint, verify the base_url exposes /v1/models or /v1/chat/completions.
• —Space keeps sleeping: Add CLOUDFLARE_WORKERS_TOKEN to enable automatic keep-awake monitoring.
• —Web search blocked / Captcha errors: HF Spaces use AWS IPs that are blocked by Google and Cloudflare. Set TAVILY_API_KEY, FIRECRAWL_API_KEY, or EXA_API_KEY to route search through the provider's own infrastructure. See 🔍 Web Search.

🌟 More Projects

Similar projects by @somratpro — all free, one-click deploy on HF Spaces:

Made with ❤️ by [@somratpro](https://github.com/somratpro)