Ankh- Morpok on Nostr: Setting up Hermes agent: a practical checklist Steps, addresses, pitfalls. No theory. ...

Setting up Hermes agent: a practical checklist

Steps, addresses, pitfalls. No theory.

Use a machine you can afford to lose. It has file, terminal and email access, so it will sometimes change or delete the wrong thing.

1. A MAILBOX YOU OWN

https://proton.me - Free plan, no card. A username that does not identify you. 2FA on immediately, and write the recovery phrase down: Proton cannot reset your password.

No IMAP or SMTP on free, so no mail client can read that mailbox. Fine here - just know it.

2. DIFFERENT ADDRESSES

Several separate free Proton accounts, one per group of services. Each gives ONE address, so 3 or 4 addresses means 3 or 4 accounts, each with its own password and recovery phrase.

Proton's terms prohibit "operating a large number of free Accounts for a single organization or individual". A few personal accounts is not bulk signup, but know where you stand.

3. YOUR IDENTITY IS THREE THINGS

DATE OF BIRTH: never the real one unless the law requires it. It resets passwords, it links records about you, and you cannot change it. Use a consistent near-date.

PHONE: services demand one for SMS verification. Rent one:

https://nadanada.me - disposable or rental, about $1.50, no account

https://sms4sats.com - one-time, 1,500 sats

A one-time number cannot receive a SECOND SMS: if the service texts again for a login or recovery code, you are locked out for good. Rent one you keep. Whoever rents it sees every code sent to it, so never for a bank.

4. A MODEL

https://platform.deepseek.com - sign up with one of your addresses, not your real one. Top up small, on a disposable card or with bitcoin - never the card that pays your bills. Copy the API key as soon as you make it.

5. INSTALL HERMES

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

hermes setup, paste that key, then hermes doctor until it is green.

Secrets in ~/.hermes/.env, settings in config.yaml - never hand-edit config.yaml, one stray space corrupts it.

6. THEN HAND IT OVER

Name the outcome and let it work out the commands. "Get my email working" beats "run this command". Every step below, just ask:

"Hermes, look into setting up ..." / "Hermes, give me detailed instructions on ..."

7. ITS OWN EMAIL

AgentMail will likely reject your Proton address at signup - it blocklists some provider domains. https://atomicmail.io worked: free, 10 aliases, no phone needed.

Then https://console.agentmail.to - API key, then an inbox. Verify the 6-digit code or sending is blocked. A new inbox silently rejects unknown senders: if a verification email vanishes, check the allow-list.

8. REACH IT FROM YOUR PHONE

https://tailscale.com/download on both, same account.

hermes dashboard (it binds to localhost - leave it), then: tailscale serve --bg 9119

Serve shares with your own devices. Funnel publishes to the whole internet. Never funnel the dashboard - a funnelled shell is a shell online.

9. VISION

DeepSeek Flash already reads images, nothing to set up.

To keep images on your own machine instead, ask your agent to set up qwen3-vl on Ollama:

https://ollama.com

10. IMAGES

https://ppq.ai - one key, many models, grok-imagine among them at a few cents an image. The key is a wallet: keep top-ups small.

11. PRACTICAL ADVICE

SKILLS: after each thing works, have the agent write it down as a skill. Same prefix on every name so they group, amnesia-proof, tested in a fresh session. "Hermes, set up a skill called 'Arnie-email'; write what you learned and make it amnesia-proof, so even if you forget everything you can get back to where you are now."

ADVERSARIAL CHECK: add "and then check it adversarially, argue against it, try to break it" to any request. Critical errors get found.

BACKUPS: get the path, write it down outside the machine, make it test the restore, and ask which part goes where and what it excludes. A backup nobody has restored from is a hope.

ONE NOTE PER SERVICE: the address you used, any rented number, where the secret lives. Where things are, not the secrets.

BITCOIN: where a service takes it, pay with it - no card number to steal, nothing to reuse. Where it does not, a disposable virtual card does the same job.

REPETITION: nothing works the first time, or the tenth. Sometimes the forty-second.

12. WHAT NOT TO DO

Do not expose the dashboard. Do not give an agent your main mailbox or brokerage credentials. Do not treat a confident answer as a correct one - it sounds the same either way.