Private AI infrastructure
Always-on
Hermes.
A workstation-bound AI agent moved into a private, always-on Debian virtual machine while preserving local desktop control and keeping every remote service off the public internet.
01 / Overview
Hermes originally ran only on my Omarchy workstation. I moved its persistent services into a Debian VM on Proxmox so scheduled work, messaging, and remote sessions can continue when the workstation is unavailable.
The workstation retains a separate local installation for tasks that need direct access to Omarchy, desktop applications, and local files. Tailscale provides the private network boundary between both environments.
02 / What the project solved
- Preserved conversations, memory, skills, scheduled jobs, source files, Git history, untracked work, and project configuration.
- Separated durable state from regenerable dependencies, caches, environments, and build output.
- Moved messaging through a rollback-safe cutover without running duplicate gateways.
- Kept dashboards, backends, SSH, and integrations private through Tailscale and least-privilege access.
- Retained the local Hermes installation for machine-specific desktop work.
03 / Development notes
The migration was treated as an infrastructure project rather than a file copy. Every major step had a rollback path, and verification checked application state, adapter connectivity, database integrity, permissions, and real outbound delivery—not just whether a process appeared to be running.
The resulting pattern now guides future homelab integrations: private networking, dedicated credentials, tightly constrained operations, structured health checks, and no public exposure.