How to Expose Hermes Agent Privately with Cloudflare WARP

A common challenge arises when you want to access your Hermes Agent from other devices such as laptops, tablets, or phones without exposing it to the public internet. Utilizing Cloudflare WARP with Cloudflare Zero Trust allows you to expose the Hermes Agent globally without opening a single inbound port on your firewall.

If you followed our previous guide, 'How to Deploy Hermes Agent on a Linux VPS', a Hermes Agent is already up and running 24/7. Instead of dealing with the overhead of traditional VPNs, we will use the Cloudflare WARP client to expose the Hermes Agent to a private network over the internet.

Understanding the Architecture

The components at play:

1. Cloudflare Zero Trust: The dashboard at Cloudflare where you define routing rules and access policies.
2. Cloudflare WARP: The client application installed on your devices (VPS, laptops, phones). It intercepts traffic destined for your private network and routes it securely.

Prerequisites

• A running Hermes Agent on your VPS.
• A free Cloudflare account.

Step-by-Step Guide

Step 1: Set Up Cloudflare Zero Trust

1. Log in to your Cloudflare Dashboard.
2. Click on 'Zero Trust' from the left menu.
3. If this is your first time, you will be prompted to choose a plan (the Free tier is perfectly fine for this setup) and name your team (e.g., ai-team).
4. Click on 'Access' then 'Policies' to create an access policy defining who has access to the network.
5. Click on 'Create new policy'.
6. Select 'Emails' and enter your email under 'Policy rules'.

Step 2: Set Up Cloudflare WARP Client on VPS

1. Run sudo apt update and sudo apt install cloudflare-warp in the terminal on your VPS.
2. Run warp-cli registration new <TEAM-NAME> in the terminal on your VPS, which will print out a URL.
3. Copy the printed URL, which will look like https://<team>.cloudflareaccess.com/warp, and paste it in your browser for authentication.
4. Since email authentication is used in the policy rule setup above, enter your email to authenticate.
5. On the 'Success' page in the browser, right-click and select 'Inspect' on the blue 'Open Cloudflare WARP' button.
6. Copy the long token that is shown in the button's link.
7. Run warp-cli --accept-tos registration token "https://<team>.cloudflareaccess.com/auth?token=<copied_token>" in the terminal on your VPS to connect it to Cloudflare Zero Trust.
   If the 'Error: Failed to communicate with the WARP API' is encounter on Ubuntu 26, run the following commands:

   sudo systemctl restart warp-svc.service
   
   # Check status
   sudo systemctl status warp-svc.service
   
   # Run the warp-cli registration token again
   warp-cli --accept-tos registration token   "https://<team>.cloudflareaccess.com/auth?token=<copied_token>"
   

8. Head back to the Cloudflare Zero Trust dashboard, and click on 'Devices'. Your VPS device should now be displayed.

Step 3: Set Up Traffic Routing

1. Click the profile for your VPS on the Devices dashboard.
2. Scroll down to the 'Split Tunnels' section.
3. Click the 'Manage' button and configure the settings as shown below. Replace the IP address if necessary.
4. Exposing the address and host will route traffic to your services over the same private network.

Step 4: Configure Firewall on the VPS

Enable the firewall to allow the '100.96.0.0/12' subnet only, blocking all other public incoming access.

sudo ufw enable 
sudo ufw default allow outgoing 
sudo ufw default deny incoming
sudo ufw allow in from 100.96.0.0/12

Allow loopback traffic to avoid breaking local services:

sudo ufw allow in on lo
sudo ufw allow out on lo

Reload the firewall and verify status:

sudo ufw reload 
sudo ufw status verbose

Step 5: Expose Hermes Agent to the Private Network

We will expose the Hermes Agent Web Dashboard to our private network and use the default authentication provider, Nous Research.

Set Up the Auth Provider

1. Head to portal.nousresearch.com to register an account.
2. Select 'Local Dashboards'.
3. Click 'Register Dashboard'.
4. Enter the private network IP address of your VPS as the 'Dashboard redirect URI' and click 'Save'.
5. Copy the 'OAuth client ID' and paste it in your config.yaml file:

dashboard:
  theme: default
  show_token_analytics: false
  oauth:
    client_id: agent:cmq02x7ha0002jk0ba3kfnb
    portal_url: https://portal.nousresearch.com
  basic_auth:
    username: ''
    password_hash: ''

Set Up Systemd to Autostart the Hermes Dashboard

1. Create a service file:

sudo nano /etc/systemd/system/hermes-dashboard.service

2. Paste the following configuration, ensuring --host 0.0.0.0 is part of the command:

[Unit]
Description=Hermes Dashboard
After=network.target

[Service]
User=hermes
WorkingDirectory=/home/hermes
ExecStart=/home/hermes/.local/bin/hermes dashboard --host 0.0.0.0
Restart=always
RestartSec=10
Environment=PATH=/home/hermes/.local/bin:/usr/local/bin:/usr/bin:/bin

[Install]
WantedBy=multi-user.target

3. Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable hermes-dashboard
sudo systemctl start hermes-dashboard
sudo systemctl status hermes-dashboard

Step 6: Install Cloudflare WARP Client on Desktop

1. Download the Cloudflare WARP client from Cloudflare's portal.
2. Open and launch the Cloudflare WARP client after installation.
3. Log in when prompted.
4. A 'Success' page will be displayed after a successful login.
5. The WARP client should now show it is connected to your Zero Trust team.
6. Navigate to your web browser and enter your private IP (e.g., 100.96.0.3). The Hermes Web Dashboard should load successfully.

Pro Tip for macOS Users: If you are using the WARP client to access multiple Cloudflare accounts, check out our quick guide on Switch Between Multiple Cloudflare WARP Orgs on Mac to make switching between accounts seamless.

Step 7: Install Cloudflare WARP Client on iOS Devices

1. Install Cloudflare One from the App Store.
2. Open the Cloudflare One app and enter your team name when prompted.
3. Log in using the same email address that was configured in the policy rule above.
4. Once it is connected, it should look like the following:
5. Navigate to your web browser and enter the private IP 100.96.0.3 to access the Hermes Web Dashboard on your mobile device.

Conclusion

With Cloudflare Zero Trust handling identity policies and the WARP client routing traffic over an encrypted tunnel, your Hermes Agent is securely reachable from your devices globally. This setup lays a secure, robust foundation for building and accessing a fully remote, private AI infrastructure.