The complete guide.

Hermes Console is the Android app. Hermes Agent is your self-hosted AI agent, running wherever you decide. There is no one's cloud in between: the app talks straight to your server.

Three services live on the server, and knowing them explains everything else:

• Gateway (port 8642) — the brain: chat, sessions and streaming.
• Dashboard (port 9119) — memory, cron, skills, models and configuration.
• Mobile Bridge (port 9131) — the app's companion service: pairing, approvals and remote maintenance.

The one-command installer (next section) brings all three up as user systemd services: they survive reboots without you touching a thing.

• Phone: Android 7.0 or newer. No accounts, no Google services.
• Server: a Linux box with systemd — a small VPS, a homelab or that mini-PC in a drawer will do. That's where your Hermes Agent runs.
• Network: the phone must reach the server — same LAN, a Tailscale network (recommended away from home) or direct HTTPS.

On your server, run:

curl -fsSL https://raw.githubusercontent.com/xP3ta/hermes-setup/main/hermes-mobile-setup.sh | sh

The script is idempotent (safe to re-run) and does this, in order:

1. Installs Hermes Agent if missing.
2. Ensures an API key (API_SERVER_KEY in ~/.hermes/.env) — if one exists, it is not rotated.
3. Brings up Gateway, Dashboard and Mobile Bridge as user systemd services with autostart.
4. Detects your best IP (Tailscale first, then private LAN) and avoids exposing you to the internet without warning.
5. Prints a pairing QR in the terminal, ready to scan.

Want to check everything is alive? systemctl --user status hermes-gateway hermes-dashboard hermes-bridge

Fast path — QR. Open Hermes Console, choose "Connect to my server" and scan the QR the installer printed. Done: host, port, token and dashboard configure themselves. If you're on the phone and the QR is on the same screen, you can also open the hermes://pair?… link directly.

Manual path. On the connection screen enter:

• Host — LAN IP (192.168.x.x), Tailscale IP (100.x.x.x), MagicDNS or https://your-domain
• Port — 8642 (with HTTPS behind a proxy, 443 is implied)
• API key — the value of API_SERVER_KEY in ~/.hermes/.env on the server

Lost the QR? On the server: hermes-pair.sh — prints it again, no reinstall.

Several instances. You can save more than one server (home, VPS…) and switch between them from the app's instance manager.

• Chat — token-by-token streaming, visible reasoning blocks, attachments and image generation right in the conversation.
• Sessions — every conversation of your agent, including the ones you started on desktop.
• Kanban — the agent's task board: backlog, in progress, review, blocked; bug/feature/research templates.
• Models — switch the active model, Ollama catalog, and external providers (LM Studio, OpenAI-compatible).
• MoA — Mixture-of-Agents recipes editable from the app: several models propose, one aggregates the final answer.
• SSH terminal — a real shell with a PTY against any machine, plus an SFTP browser to move files.
• Cron — scheduled jobs: create, edit, pause, trigger manually and read each run's report.
• Memory — read and edit the agent's persistent memory, with local drafts.
• SOUL — the agent's identity document (its persona), editable with templates and autosave.
• Skills — browse the skills installed on your agent.
• Task Center — every run launched from the app, with live tracking.
• Approvals — when the agent wants to run something sensitive, it arrives with its risk level: approve or reject, right from the notification.
• Spark — the Hermes mascot: mirrors your agent's state (thinking, connecting, celebrating).

• Appearance — 13 dark and light themes (including pure OLED and the "Hermes Console" theme), text size and a font picker.
• Language — Spanish and English, or follow the system.
• Security — app lock with biometrics or PIN; the API key lives encrypted in the Android Keystore.
• Notifications — approvals and finished runs in the background, with its own service: zero Google, zero third-party push.
• Server — from the app itself: update Hermes, restart the Gateway and repair/update the Bridge when it gets old (a banner warns you).

• "Can't connect". Check phone and server share a network (Tailscale up on both?), the port is 8642 and the services run: systemctl --user status hermes-gateway.
• TLS certificate error. On a private network connect over LAN or Tailscale (internal HTTP is fine there); for a public domain use a valid certificate on the proxy.
• QR expired or missing. hermes-pair.sh on the server reprints it instantly.
• "Bridge outdated". Tap the banner: the app repairs or updates it on its own.
• No notifications. Enable background listening in Settings → Notifications and grant the notification permission (Android 13+).

• Connect over LAN or Tailscale whenever you can; don't open 8642/9119 to the public internet.
• If you need access from outside, Tailscale gives you an encrypted private network with no open ports; HTTPS with a valid certificate is the alternative.
• Your API key never leaves the phone except towards your server, and is stored encrypted in the Keystore.
• The dashboard is password-protected from first boot (the installer sets it for you).
• And the usual around here: no telemetry, no accounts, no cloud. Full privacy policy →