Files

T

Frank 34918bf309 hermes: add web dashboard service (basic-auth, LAN port 9119)

Add a hermes-dashboard compose service that runs 'hermes dashboard' on
0.0.0.0:9119 with HTTP basic auth. The username + scrypt password hash
live in the git-ignored /home/dank/hermes-data config (plaintext never
stored). A separate container from the Signal gateway, since the gateway
entrypoint does not start the dashboard. Both share the data volume and
are boot-persistent. Docs page + index link added (docs-first contract).

2026-08-20 22:54:35 -07:00

1.9 KiB

Raw Blame History

Hermes-Dashboard

The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See Hermes.

Host: Dankclaw — Port: 9119 — URL: http://192.168.0.143:9119

Facts

Item	Value
Image	`docker.io/nousresearch/hermes-agent:latest` (same as the gateway)
Command	`hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build`
Port	`9119` (published to the LAN)
Auth	HTTP basic auth (username + scrypt password hash)
Data	shares `/home/dank/hermes-data` with the gateway

Why a separate container

The gateway container runs hermes gateway run (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process. So it runs in its own compose service (hermes-dashboard). Both services mount the same data volume. Both restart at boot (restart: unless-stopped).

Authentication

The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:

dashboard.basic_auth.username and dashboard.basic_auth.password_hash live in the git-ignored /home/dank/hermes-data/config.yaml.
The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
The hash is generated with plugins.dashboard_auth.basic.hash_password.

Access

Open http://192.168.0.143:9119 in a browser on the LAN. Log in with the configured username and password.

Gotchas

The dashboard and the gateway share one data volume. A config change made in the dashboard takes effect when the gateway restarts.
If the shared password is reused elsewhere, treat it as exposed. Rotate it and regenerate the hash.
--skip-build uses the prebuilt web assets in the image. Do not remove it unless the assets are rebuilt.

1.9 KiB Raw Blame History