Hermes Agent on Google Cloud Run

# Export your environment variables
$export PROJECT_ID="your-project-id"
$export REGION="us-central1"
$export BUCKET_NAME="hermes-state-${PROJECT_ID}"
$export SERVICE_ACCOUNT_NAME="hermes-sa"
$
# Set default project and update gcloud beta
$gcloud config set project $PROJECT_ID
$gcloud components install beta --quiet
$gcloud components update --quiet
$
# Enable required Google Cloud APIs
$gcloud services enable \
$  run.googleapis.com \
$  secretmanager.googleapis.com \
$  storage.googleapis.com \
$  compute.googleapis.com \
$  aiplatform.googleapis.com

# Create the service account
$gcloud iam service-accounts create ${SERVICE_ACCOUNT_NAME} \
$  --display-name="Hermes Agent Service Account"
$
$export SERVICE_ACCOUNT="${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"
$
# Grant permission to invoke Vertex AI models
$gcloud projects add-iam-policy-binding ${PROJECT_ID} \
$  --member="serviceAccount:${SERVICE_ACCOUNT}" \
$  --role="roles/aiplatform.user"

# Generate a secure password and store in Secret Manager
$export DASHBOARD_PASSWORD=$(openssl rand -hex 16)
$echo "Generated Hermes Dashboard Password: ${DASHBOARD_PASSWORD}"
$
$echo -n "${DASHBOARD_PASSWORD}" | gcloud secrets create hermes-dashboard-password \
$  --data-file=- \
$  --replication-policy="automatic"
$
# Grant the service account read access to this secret
$gcloud secrets add-iam-policy-binding hermes-dashboard-password \
$  --member="serviceAccount:${SERVICE_ACCOUNT}" \
$  --role="roles/secretmanager.secretAccessor"

# Create the Cloud Storage bucket
$gcloud storage buckets create gs://${BUCKET_NAME} --location=${REGION}
$
# Grant storage access to the service account
$gcloud storage buckets add-iam-policy-binding gs://${BUCKET_NAME} \
$  --member="serviceAccount:${SERVICE_ACCOUNT}" \
$  --role="roles/storage.objectAdmin"

$cat << 'EOF' > config.yaml
$_config_version: 12
$
$model:
$  default: "google/gemini-3.8-flash"
$  provider: "vertex"
$
$dashboard:
$  enabled: true
$
$database:
$  journal_mode: delete
$EOF

$cat << 'EOF' > run_hermes.py
$import os, shutil, subprocess, sys, threading, time, sqlite3
$
$print("=== INITIALIZING HERMES SUPERVISOR ===", flush=True)
$
$home_dir = "/tmp/hermes_home"
$hermes_dir = os.path.join(home_dir, ".hermes")
$os.makedirs(hermes_dir, exist_ok=True)
$os.makedirs("/tmp/logs", exist_ok=True)
$os.makedirs("/tmp/skills", exist_ok=True)
$os.makedirs("/tmp/uv_cache", exist_ok=True)
$os.makedirs("/tmp/cache", exist_ok=True)
$os.makedirs("/opt/data/workspace", exist_ok=True)
$os.makedirs("/opt/data/.hermes", exist_ok=True)
$
# Restore state from GCS mount
$for f in ["config.yaml", ".env", "state.db"]:
$    src = os.path.join("/opt/data/.hermes", f)
$    alt = os.path.join("/opt/data", f)
$    dst = os.path.join(hermes_dir, f)
$    if os.path.exists(src):
$        shutil.copy(src, dst)
$        print(f"Synced {f} from .hermes -> {dst}", flush=True)
$    elif os.path.exists(alt):
$        shutil.copy(alt, dst)
$        print(f"Synced {f} from root -> {dst}", flush=True)
$
# Configure SQLite TRUNCATE mode to bypass GCS FUSE locking issues
$db_path = os.path.join(hermes_dir, "state.db")
$try:
$    conn = sqlite3.connect(db_path)
$    conn.execute("PRAGMA journal_mode=TRUNCATE;")
$    conn.close()
$    print("Configured SQLite database to TRUNCATE mode", flush=True)
$except Exception as e:
$    print(f"Notice during SQLite init: {e}", flush=True)
$
$subprocess.run(["chmod", "-R", "777", "/tmp"], check=False)
$
$env = dict(os.environ)
$env["HOME"] = home_dir
$env["HERMES_HOME"] = hermes_dir
$env["PATH"] = "/opt/hermes/.venv/bin:/opt/hermes/bin:" + env.get("PATH", "")
$env["PYTHONUNBUFFERED"] = "1"
$env["HERMES_STATE_PATH"] = hermes_dir
$env["HERMES_SKILLS_PATH"] = "/tmp/skills"
$env["UV_CACHE_DIR"] = "/tmp/uv_cache"
$env["XDG_CACHE_HOME"] = "/tmp/cache"
$env["SQLITE_BUSY_TIMEOUT"] = "30000"
$env["HERMES_ALLOW_ROOT_GATEWAY"] = "1"
$env["HERMES_WORKSPACE"] = "/opt/data/workspace"
$env["HERMES_WRITE_SAFE_ROOT"] = "/opt/data"
$
$python_bin = "/opt/hermes/.venv/bin/python3"
$
# Background thread: sync state.db, config.yaml, .env every 5 seconds
$def sync_to_gcs_loop():
$    files = ["state.db", "config.yaml", ".env"]
$    last_mtimes = {f: os.path.getmtime(os.path.join(hermes_dir, f)) if os.path.exists(os.path.join(hermes_dir, f)) else 0 for f in files}
$    while True:
$        time.sleep(5)
$        for f in files:
$            src = os.path.join(hermes_dir, f)
$            if os.path.exists(src):
$                try:
$                    mtime = os.path.getmtime(src)
$                    if mtime > last_mtimes.get(f, 0):
$                        shutil.copy2(src, os.path.join("/opt/data/.hermes", f))
$                        last_mtimes[f] = mtime
$                        print(f"Auto-saved {f} to GCS volume mount", flush=True)
$                except Exception as e:
$                    print(f"Error auto-saving {f} to GCS: {e}", flush=True)
$
$threading.Thread(target=sync_to_gcs_loop, daemon=True).start()
$
# Launch Hermes Gateway
$print("=== STARTING GATEWAY IN BACKGROUND ===", flush=True)
$gw = subprocess.Popen([python_bin, "-m", "hermes_cli.main", "gateway", "run"], env=env, cwd="/opt/data/workspace")
$
# Launch Web Dashboard on 0.0.0.0:8080
$print("=== STARTING DASHBOARD ON 0.0.0.0:8080 ===", flush=True)
$dash = subprocess.Popen([python_bin, "-m", "hermes_cli.main", "dashboard", "--host", "0.0.0.0", "--port", "8080", "--skip-build"], env=env, cwd="/opt/data/workspace")
$
$dash.wait()
$EOF

$cat << 'EOF' > start_hermes.sh
#!/bin/sh
$set -e
$export PYTHONUNBUFFERED=1
$exec python3 /opt/data/run_hermes.py
$EOF
$
# Upload config and scripts to the bucket
$gcloud storage cp config.yaml run_hermes.py start_hermes.sh gs://${BUCKET_NAME}/

$gcloud beta run instances deploy hermes-instance \
$  --image nousresearch/hermes-agent:latest \
$  --service-account ${SERVICE_ACCOUNT} \
$  --command "/bin/sh" \
$  --args "/opt/data/start_hermes.sh" \
$  --port 8080 \
$  --cpu 2 \
$  --memory 4Gi \
$  --ingress all \
$  --no-invoker-iam-check \
$  --add-volume name=hermes-storage,mount-path=/opt/data,type=cloud-storage,mount-options="uid=2000;gid=2000;file-mode=0777;dir-mode=0777;implicit-dirs",bucket=${BUCKET_NAME} \
$  --set-secrets "HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=hermes-dashboard-password:latest" \
$  --set-env-vars "PYTHONUNBUFFERED=1,VERTEX_PROJECT_ID=${PROJECT_ID},VERTEX_LOCATION=global,HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin,HERMES_ALLOW_ROOT_GATEWAY=1,HERMES_WORKSPACE=/opt/data/workspace,HERMES_WRITE_SAFE_ROOT=/opt/data" \
$  --region ${REGION} \
$  --project ${PROJECT_ID}

# Print your instance URL and password
$INSTANCE_URL=$(gcloud beta run instances describe hermes-instance --region $REGION --format="value(status.urls[0])")
$echo "Hermes Dashboard URL: $INSTANCE_URL"
$echo "Username: admin"
$echo "Password: $(gcloud secrets versions access latest --secret=hermes-dashboard-password)"