Spaces:
Running
Running
| title: Hermes Agent WebUI | |
| emoji: 👁 | |
| colorFrom: blue | |
| colorTo: gray | |
| sdk: docker | |
| app_port: 8787 | |
| pinned: false | |
| license: mit | |
| # Hermes Agent WebUI Space | |
| This Space runs the community Hermes WebUI with Hermes Agent source available in | |
| the container. | |
| ## Required Space secrets | |
| Set these in Hugging Face Space settings before exposing the app: | |
| - `HERMES_WEBUI_PASSWORD`: password for the browser UI. | |
| Optional provider secrets: | |
| - `DEEPSEEK_API_KEY` | |
| - `OPENAI_API_KEY` | |
| - `OPENROUTER_API_KEY` | |
| - `ANTHROPIC_API_KEY` | |
| - `GOOGLE_API_KEY` | |
| - `HF_TOKEN` | |
| Optional runtime secret: | |
| - `HERMES_WEBUI_USER_PASSWORD`: sets the `hermeswebui` Linux user password and | |
| enables password-based `sudo` inside the container. Use only when you need it. | |
| Optional backup settings: | |
| - `HERMES_BACKUP_REPO`: private Dataset repo used for Hermes state backups, for | |
| example `Acrabohan/hermes-webui-backup`. | |
| - `HF_BACKUP_TOKEN`: fine-grained Hugging Face token with read/write access to | |
| the private backup Dataset. Set this as a Space secret, not a public variable. | |
| - `HERMES_BACKUP_INTERVAL_SECONDS`: backup interval, default `1800`. | |
| - `HERMES_BACKUP_INITIAL_DELAY_SECONDS`: first backup delay after container | |
| start, default `300`. | |
| - `HERMES_RESTORE_ON_START`: set to `0` to disable automatic restore on boot. | |
| - `HERMES_FORCE_RESTORE`: set to `1` once if you want to overwrite local state | |
| from the backup archive on the next boot. | |
| ## Workspace and state | |
| The default workspace is `/workspace`. | |
| Hermes reads and writes its state at `/home/hermeswebui/.hermes`. In this Space | |
| that path is a symlink to `/data/.hermes`, so Hermes Agent and Hermes WebUI use | |
| one shared home directory. On a free Space this is ephemeral and can be lost | |
| after rebuilds. Enable Hugging Face persistent storage if you want Hermes memory, | |
| sessions, and profile configuration to survive rebuilds. | |
| If `HERMES_BACKUP_REPO` and `HF_BACKUP_TOKEN` are set, the container also backs | |
| up Hermes state to the private Dataset as `hermes-state.tar.gz`. On startup, it | |
| restores from that archive only when the local Hermes state is empty, unless | |
| `HERMES_FORCE_RESTORE=1` is set. | |
| ## Security notes | |
| Use a private or protected Space. This app can inspect files and run agent tools, | |
| so do not publish it without `HERMES_WEBUI_PASSWORD`. | |
| If you set `HERMES_WEBUI_USER_PASSWORD`, anyone who can control the WebUI may be | |
| able to run privileged commands inside the container. Prefer baking system | |
| packages into the Dockerfile instead of using sudo at runtime. | |
| Keep the backup Dataset private. Hermes state can include memories, sessions, | |
| provider configuration, and secrets. Do not set `HERMES_BACKUP_REPO` to this | |
| public Space repo. | |
| This repo intentionally does not include keep-alive automation. Free Spaces can | |
| sleep; for always-on usage, use paid hardware or accept cold starts. | |