README.md

metadata

title: Hermes Agent WebUI
emoji: 👁
colorFrom: blue
colorTo: gray
sdk: docker
app_port: 8787
pinned: false
license: mit

Hermes Agent WebUI Space

This Space runs the community Hermes WebUI with Hermes Agent source available in the container.

Required Space secrets

Set these in Hugging Face Space settings before exposing the app:

• HERMES_WEBUI_PASSWORD: password for the browser UI.

Optional provider secrets:

• DEEPSEEK_API_KEY
• OPENAI_API_KEY
• OPENROUTER_API_KEY
• ANTHROPIC_API_KEY
• GOOGLE_API_KEY
• HF_TOKEN

Optional runtime secret:

• HERMES_WEBUI_USER_PASSWORD: sets the hermeswebui Linux user password and enables password-based sudo inside the container. Use only when you need it.

Optional backup settings:

• HERMES_BACKUP_REPO: private Dataset repo used for Hermes state backups, for example Acrabohan/hermes-webui-backup.
• HF_BACKUP_TOKEN: fine-grained Hugging Face token with read/write access to the private backup Dataset. Set this as a Space secret, not a public variable.
• HERMES_BACKUP_INTERVAL_SECONDS: backup interval, default 1800.
• HERMES_BACKUP_INITIAL_DELAY_SECONDS: first backup delay after container start, default 300.
• HERMES_RESTORE_ON_START: set to 0 to disable automatic restore on boot.
• HERMES_FORCE_RESTORE: set to 1 once if you want to overwrite local state from the backup archive on the next boot.

Workspace and state

The default workspace is /workspace.

Hermes reads and writes its state at /home/hermeswebui/.hermes. In this Space that path is a symlink to /data/.hermes, so Hermes Agent and Hermes WebUI use one shared home directory. On a free Space this is ephemeral and can be lost after rebuilds. Enable Hugging Face persistent storage if you want Hermes memory, sessions, and profile configuration to survive rebuilds.

If HERMES_BACKUP_REPO and HF_BACKUP_TOKEN are set, the container also backs up Hermes state to the private Dataset as hermes-state.tar.gz. On startup, it restores from that archive only when the local Hermes state is empty, unless HERMES_FORCE_RESTORE=1 is set.

Security notes

Use a private or protected Space. This app can inspect files and run agent tools, so do not publish it without HERMES_WEBUI_PASSWORD.

If you set HERMES_WEBUI_USER_PASSWORD, anyone who can control the WebUI may be able to run privileged commands inside the container. Prefer baking system packages into the Dockerfile instead of using sudo at runtime.

Keep the backup Dataset private. Hermes state can include memories, sessions, provider configuration, and secrets. Do not set HERMES_BACKUP_REPO to this public Space repo.

This repo intentionally does not include keep-alive automation. Free Spaces can sleep; for always-on usage, use paid hardware or accept cold starts.