Run Hermes on a VPS without Leaking your API keys

Run an AI coding agent on a remote VPS without ever putting real API keys on the agent host. I deploy Hermes Agent on one Hetzner VPS and Agent Vault on another. Every outbound call (Anthropic, GitHub, Slack, Telegram) routes through Agent Vault, which swaps placeholder strings for real credentials at the wire boundary. The agent host holds only placeholders and one revocable token, Vault, which swaps placeholder strings for real credentials at the wire boundary. 📖 Full step-by-step guide: https://docs.agent-vault.dev/guides/hermes-on-vps What's covered: • Two-VPS setup on a private Hetzner network with SSH locked down • Agent Vault install + vaults, credentials, services, substitution rules • Hermes first-run wizard and gateway daemon (systemd) • Telegram bot for remote agent access • Optional egress firewall lockdown • End-to-end test plus live credential revocation 🔗 Agent Vault: https://github.com/Infisical/agent-vault 🔗 Hermes Agent: https://github.com/NousResearch/hermes-agent 🔗 Hetzner Cloud: https://www.hetzner.com/cloud Follow Infisical: Website: https://infisical.com LinkedIn: https://www.linkedin.com/company/infisical GitHub: https://github.com/Infisical Twitter / X: https://x.com/infisical Slack: https://infisical.com/slack