Self-Hosting Hermes AI Agent: Mac Mini vs. DigitalOcean VPS, Secured with Tailscale or ZeroTier

Quick answer: Hermes AI Agent (by Nous Research, MIT-licensed) is a persistent, self-hosted AI agent — and the two most practical homes for it are a Mac Mini on your desk or a DigitalOcean VPS in the cloud. Install it with a single shell command, connect it to a cloud LLM API or a local model via Ollama, and never expose it to the public internet: put it behind a Tailscale or ZeroTier overlay network so only your own devices can reach it. This guide walks through both hardware options and both security options, step by step.

What Is Hermes AI Agent?

Hermes Agent is an open-source autonomous AI agent released by Nous Research in early 2026 under the MIT license. Unlike a chatbot that forgets you the moment a session ends, Hermes runs as a persistent daemon on your own machine. It accumulates memory across sessions, schedules and runs cron-style tasks while you are away, writes its own reusable skills from experience, and can reach you through messaging platforms such as Telegram, Discord, Slack, and email. If you are still deciding between Hermes and the other framework it is most often benchmarked against, read our OpenClaw vs Hermes Agent comparison.

Crucially, Hermes is provider-agnostic. You can point it at a cloud LLM API (Anthropic, OpenAI, Google, OpenRouter, and others) or at a fully local model served by Ollama or vLLM — meaning it can run with zero per-token cost and zero data leaving your hardware. That flexibility is exactly why the hosting decision matters: the hardware you choose determines which of those modes are realistic.

Why Self-Host an AI Agent at All?

• Data ownership. Your files, credentials, conversation history, and the agent’s accumulated memory live on infrastructure you control — not in a third-party dashboard.
• Always-on automation. A self-hosted agent can run scheduled jobs (report generation, monitoring, inbox triage) 24/7 without a browser tab open anywhere.
• Cost control. With a local model via Ollama, inference is free after the hardware. With a cloud API, you pay only for tokens — no per-seat SaaS subscription.
• No vendor lock-in. Because Hermes speaks to any OpenAI-compatible endpoint, you can swap the underlying model without rebuilding your workflows.

Option 1: Hermes on a Mac Mini

An Apple Silicon Mac Mini is arguably the best consumer hardware for a home AI agent. Its unified memory architecture lets the GPU address the same RAM pool as the CPU, so a Mac Mini with 24–32 GB of memory can comfortably serve 13B–14B parameter models through Ollama — and higher-memory configurations can handle much larger ones. It idles at just a few watts, runs silently, and sits on your local network with no monthly bill.

Choose the Mac Mini when: you want fully local inference (no data leaves your home), you already own one or don’t mind a one-time hardware purchase, and you’re comfortable with the machine living behind your home router. The main trade-offs are residential power/internet reliability and the fact that “remote access” now depends entirely on the VPN layer we’ll set up below — which, as it happens, solves the problem completely.

Option 2: Hermes on a DigitalOcean VPS

A DigitalOcean Droplet gives you the opposite profile: data-center uptime, a static public IP, snapshots and automated backups, and the ability to resize the machine in minutes. For Hermes paired with a cloud LLM API, even a modest Droplet (2 vCPU / 4 GB RAM, Ubuntu 22.04+) is sufficient — the heavy lifting happens at the API provider, and the Droplet only runs the agent process itself.

Choose the VPS when: you want guaranteed uptime for scheduled tasks and messaging gateways, you’re using a cloud LLM provider anyway, or you don’t want an always-on machine at home. The trade-off: running large local models on a CPU Droplet is impractical, and GPU Droplets get expensive quickly. A VPS is also, by definition, on the public internet — which makes the security section below non-negotiable rather than optional.

Mac Mini vs. DigitalOcean at a Glance

	Mac Mini (Apple Silicon)	DigitalOcean VPS
Best pairing	Local models via Ollama	Cloud LLM APIs
Ongoing cost	Electricity only	Monthly Droplet fee + API tokens
Local LLM capability	Excellent (unified memory)	Poor on CPU Droplets
Uptime	Depends on home power/ISP	Data-center grade
Privacy ceiling	Highest — nothing leaves the LAN	High, but data transits provider infra
Attack surface	Behind home NAT by default	Public IP — must be hardened
Scaling	Fixed at purchase	Resize in minutes

A popular hybrid: run Hermes on a small Droplet for 24/7 reliability, and point it at an Ollama instance on your Mac Mini over the same private VPN — best of both worlds.

Step-by-Step Installation

1. Install Hermes Agent

The installer is the same one-liner on macOS and Ubuntu. It provisions its own isolated Python environment (via uv), pulls dependencies like Node.js and ripgrep, and sets up the hermes CLI:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

On a fresh DigitalOcean Droplet, create a non-root user first and run the installer as that user. When it finishes, run the interactive setup wizard and health check:

hermes setup
hermes doctor

2. Connect a Model Provider

Run hermes model to pick a provider interactively. For a cloud API, paste your key and you’re done. For a fully local setup on the Mac Mini, install Ollama first and pull a tool-calling-capable model:

# On the Mac Mini
brew install ollama
ollama pull qwen3:14b   # or another function-calling model that fits your RAM

Then point Hermes at Ollama’s OpenAI-compatible endpoint at http://localhost:11434/v1. One detail that trips up almost everyone: Ollama defaults to a small context window, which is far too tight for an agent whose memory and skills consume tokens quickly. Raise it to at least 64K (for example by setting OLLAMA_CONTEXT_LENGTH=65536 before starting the Ollama server, or via a model parameter) or Hermes will behave erratically.

3. Keep It Running

Hermes runs in the foreground by default. On a VPS, run it inside tmux for a quick start, or write a proper systemd unit for a real daemon that survives reboots. On macOS, a launchd agent (or simply Login Items plus energy settings that prevent sleep) achieves the same. Enable a messaging gateway (Telegram or Discord are the easiest) so the agent can reach you proactively.

Locking It Down: Tailscale or ZeroTier

Here is the rule that matters more than any other in this guide: never expose Hermes, its dashboard, or your Ollama port to the public internet. An AI agent with shell access, file access, and stored credentials is one of the most valuable targets you could possibly publish. No port forwarding on your home router, no 0.0.0.0 bindings on the Droplet, no “temporary” firewall exceptions.

Instead, use an overlay network — a modern mesh VPN that makes all your devices behave as if they were on the same private LAN, wherever they physically are. The two leading options are Tailscale and ZeroTier. Both encrypt end-to-end, both punch through NAT without router configuration, and both mean your agent is reachable only from devices you have explicitly enrolled.

Setting Up Tailscale

Tailscale is built on WireGuard and is the fastest path to a working private network. Install it on the Hermes host and on every device that should reach it:

# Ubuntu (DigitalOcean Droplet)
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# macOS (Mac Mini)
brew install --cask tailscale
# then sign in from the menu bar app

Each device gets a stable private address in the 100.x.x.x range, and with MagicDNS enabled you can reach the host by name — http://mac-mini:11434 instead of memorizing IPs. From there, tighten things further: use Tailscale ACLs so only your laptop and phone can reach the Hermes host, and on a Droplet, configure the firewall so the agent’s ports accept traffic exclusively on the tailscale0 interface.

Setting Up ZeroTier

ZeroTier works at a lower level — it emulates an Ethernet network (Layer 2), which makes it feel even more like a real LAN and gives you finer control over addressing. Create a network at my.zerotier.com, then join each device:

# Ubuntu
curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join <YOUR_NETWORK_ID>

# macOS
brew install --cask zerotier-one
sudo zerotier-cli join <YOUR_NETWORK_ID>

Keep the network set to private so every new device must be manually authorized in the web console before it gets an address. That authorization step is your access control: an attacker who discovers your network ID still cannot join without your approval.

Tailscale vs. ZeroTier: Which One?

	Tailscale	ZeroTier
Foundation	WireGuard (Layer 3)	Custom protocol (Layer 2)
Setup friction	Lowest — sign in and go	Low — create network, authorize devices
Identity model	SSO (Google, GitHub, etc.)	Per-device authorization
Access control	Powerful ACL policy language	Flow rules on the network
Naming	MagicDNS built in	Manual or self-managed DNS
Self-hostable control plane	Yes, via Headscale (community)	Yes, official self-hosted controller
Free tier	Generous for personal use	Generous for personal use

Our recommendation for most Hermes setups is Tailscale: MagicDNS and the ACL system make the “only my devices, only these ports” posture trivial to express. Pick ZeroTier if you specifically want Layer 2 semantics, custom IP ranges, or a fully self-hosted network controller with no third-party identity provider involved.

Hardening Checklist

• Firewall first. On the Droplet: ufw default deny incoming, allow SSH (key-only, no passwords), and allow Hermes/Ollama ports only on the VPN interface.
• Bind to the right interface. Keep Hermes and Ollama listening on localhost or the VPN address — never on the public interface.
• Sandbox the agent’s shell. On shared or production infrastructure, configure one of Hermes’s sandbox backends (Docker is the simplest) so the agent’s commands run isolated from the host.
• Scope the credentials. Give the agent API keys and tokens with the minimum permissions its tasks actually need, and rotate them periodically.
• Back up the brain. Hermes’s memory and skills live under ~/.hermes/ — snapshot it regularly. On DigitalOcean, enable automated Droplet backups as a second layer.
• Update deliberately. Run hermes update on your schedule, after reading release notes — an autonomous agent is not the place for unattended upgrades.

Frequently Asked Questions

Can I run Hermes on a $6 DigitalOcean Droplet?

For the agent itself paired with a cloud LLM API — yes, a small Droplet works, though 4 GB of RAM gives you comfortable headroom for the gateway and tools. What you cannot do on a budget Droplet is serve a capable local model; that job belongs to real GPU hardware or a Mac with plenty of unified memory.

Is a VPN really necessary if Hermes only listens on localhost?

If you will only ever SSH into the box, localhost binding plus hardened SSH is defensible. But the moment you want the dashboard on your phone, a web UI from your laptop, or a Droplet talking to your home Ollama, you need private connectivity between machines — and an overlay network delivers that without opening a single public port.

Tailscale or ZeroTier — is one more secure than the other?

Both are considered strong, well-audited options with end-to-end encryption. The practical difference is operational: Tailscale ties access to your identity provider and expresses policy in ACLs, while ZeroTier ties access to per-device authorization. Choose based on how you prefer to manage trust, not on encryption strength.

Need Help Building This?

Self-hosting an AI agent touches infrastructure, networking, and security all at once — and getting the boundaries right is what separates a powerful private assistant from a liability. At obalaban, we design and deploy custom software and AI-assisted automation for businesses, from architecture decisions like the ones in this guide to full production rollouts. Prefer to have it done for you? Our professional AI agent setup service installs, hardens, and configures Hermes Agent or OpenClaw on infrastructure you own. If you’d like a hand planning or hardening your own agent setup, get in touch.