> the one-command installer

Stand up your agent
in one command.

Paste it on a fresh Ubuntu VPS. It builds a de-privileged, hardened agent that lives in Slack — a Codex brain, persistent memory, daily backups. Secrets stay in 1Password; nothing sensitive touches disk.

# 1 · clone   2 · cd in   3 · run (drop in your 1Password service-account token + vault)
git clone https://github.com/HypeOrShip/hermes-personal-agent-installer.git
cd hermes-personal-agent-installer
sudo env OP_SERVICE_ACCOUNT_TOKEN='ops_YOUR_TOKEN' OP_VAULT='YourVault' bash install.sh --steps all

Want to look before you leap? Add --dry-run — it previews every change and touches nothing. Every step is verified on a fresh Ubuntu runner in CI.

View the code on GitHub → Setup checklist ▸ Watch the builds

🛡️

Hardened by default

Runs as a de-privileged user — never root — behind UFW + fail2ban, Tailscale-ready, as a systemd service that survives reboot.

💬

Lives in Slack

Replies to everything in its own channel, no @mention needed. Thinks with Codex and falls back to OpenRouter.

🧠

Remembers & backs up

Persistent memory across sessions, plus a daily config backup to a private GitHub repo — secrets scrubbed.

What you'll need

You bring the accounts; the installer wires them together.

A VPS you own — fresh Ubuntu, root/sudo. The agent's always-on home.

1Password (paid) — a read-only service account; every secret lives here.

ChatGPT / Codex — the primary brain (a ~30-sec device-code login).

OpenAI API key — memory + voice (required).

OpenRouter API key — the model fallback.

Slack workspace — where you talk to your agent.

GitHub — a private repo + fine-scoped PAT for the daily backup.

Tailscale (optional) — private access to the box.