Gateway API (port 8642) — OpenAI-compatible endpoint.
Notable, doc-grounded choices
The gateway API is disabled and loopback-bound by default upstream, so it would be unreachable behind Traefik. The template sets API_SERVER_ENABLED=true, API_SERVER_HOST=0.0.0.0, and a generated API_SERVER_KEY (bearer token) so the published 8642 domain actually works.
Hermes' dashboard auto-enters auth-gated mode once it binds off-loopback (which it does behind Traefik). The template wires up the bundled basic-auth provider (HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin + a generated 128-char password and session secret) so the public domain isn't left unauthenticated.
Image pinned to nousresearch/hermes-agent:v2026.6.19; meta.json version matches.
Config/keys persist in the hermes_data volume.
⚠️ Security — enable HTTPS before use
Dokploy creates template domains over plaintext HTTP by default (certificateType: "none"). Until you enable TLS, the dashboard credentials and the gateway bearer token travel in cleartext. After deploy, edit each domain in Dokploy → Domains to enable HTTPS + Let's Encrypt (with HTTP→HTTPS redirect). The *.sslip.io host resolves to your server IP, so the certificate issues automatically. Only then is the basic-auth / bearer-token protection meaningful.
After deploy
Open the dashboard domain (user admin, password from the generated env var) and configure a model provider key (e.g. Anthropic/OpenAI). The API bearer token is the generated API_SERVER_KEY env var.
Validated locally with the repo's validate-template.ts, validate-docker-compose.ts, and process-meta.js — all pass.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/Dokploy/templates/pull/960
**Author:** [@vikyw89](https://github.com/vikyw89)
**Created:** 6/25/2026
**Status:** ✅ Merged
**Merged:** 7/7/2026
**Merged by:** [@Siumauricio](https://github.com/Siumauricio)
**Base:** `canary` ← **Head:** `add-hermes-template`
---
### 📝 Commits (1)
- [`3859b21`](https://github.com/Dokploy/templates/commit/3859b2125d1db49a3293f764827141b031001f70) feat: add Hermes agent template
### 📊 Changes
**4 files changed** (+78 additions, -0 deletions)
<details>
<summary>View changed files</summary>
➕ `blueprints/hermes/docker-compose.yml` (+27 -0)
➕ `blueprints/hermes/logo.png` (+0 -0)
➕ `blueprints/hermes/template.toml` (+33 -0)
📝 `meta.json` (+18 -0)
</details>
### 📄 Description
## Hermes
Adds a template for [Hermes](https://hermes-agent.nousresearch.com/), the open agent runtime from Nous Research — an OpenAI-compatible gateway API plus a supervised web dashboard.
Based on the upstream [Docker Compose example](https://hermes-agent.nousresearch.com/docs/user-guide/docker), adapted to Dokploy conventions.
### What it exposes
- **Dashboard** (port 9119) — primary UI; configure provider keys, skills, and memories here.
- **Gateway API** (port 8642) — OpenAI-compatible endpoint.
### Notable, doc-grounded choices
- The gateway API is **disabled and loopback-bound by default** upstream, so it would be unreachable behind Traefik. The template sets `API_SERVER_ENABLED=true`, `API_SERVER_HOST=0.0.0.0`, and a generated `API_SERVER_KEY` (bearer token) so the published `8642` domain actually works.
- Hermes' dashboard auto-enters **auth-gated mode** once it binds off-loopback (which it does behind Traefik). The template wires up the bundled basic-auth provider (`HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin` + a generated 128-char password and session secret) so the public domain isn't left unauthenticated.
- Image pinned to `nousresearch/hermes-agent:v2026.6.19`; `meta.json` version matches.
- Config/keys persist in the `hermes_data` volume.
### ⚠️ Security — enable HTTPS before use
Dokploy creates template domains over plaintext HTTP by default (`certificateType: "none"`). Until you enable TLS, the dashboard credentials **and** the gateway bearer token travel in cleartext. After deploy, edit each domain in **Dokploy → Domains** to enable **HTTPS + Let's Encrypt** (with HTTP→HTTPS redirect). The `*.sslip.io` host resolves to your server IP, so the certificate issues automatically. Only then is the basic-auth / bearer-token protection meaningful.
### After deploy
Open the dashboard domain (user `admin`, password from the generated env var) and configure a model provider key (e.g. Anthropic/OpenAI). The API bearer token is the generated `API_SERVER_KEY` env var.
Validated locally with the repo's `validate-template.ts`, `validate-docker-compose.ts`, and `process-meta.js` — all pass.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/Dokploy/templates/pull/960
Author: @vikyw89
Created: 6/25/2026
Status: ✅ Merged
Merged: 7/7/2026
Merged by: @Siumauricio
Base:
canary← Head:add-hermes-template📝 Commits (1)
3859b21feat: add Hermes agent template📊 Changes
4 files changed (+78 additions, -0 deletions)
View changed files
➕
blueprints/hermes/docker-compose.yml(+27 -0)➕
blueprints/hermes/logo.png(+0 -0)➕
blueprints/hermes/template.toml(+33 -0)📝
meta.json(+18 -0)📄 Description
Hermes
Adds a template for Hermes, the open agent runtime from Nous Research — an OpenAI-compatible gateway API plus a supervised web dashboard.
Based on the upstream Docker Compose example, adapted to Dokploy conventions.
What it exposes
Notable, doc-grounded choices
API_SERVER_ENABLED=true,API_SERVER_HOST=0.0.0.0, and a generatedAPI_SERVER_KEY(bearer token) so the published8642domain actually works.HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin+ a generated 128-char password and session secret) so the public domain isn't left unauthenticated.nousresearch/hermes-agent:v2026.6.19;meta.jsonversion matches.hermes_datavolume.⚠️ Security — enable HTTPS before use
Dokploy creates template domains over plaintext HTTP by default (
certificateType: "none"). Until you enable TLS, the dashboard credentials and the gateway bearer token travel in cleartext. After deploy, edit each domain in Dokploy → Domains to enable HTTPS + Let's Encrypt (with HTTP→HTTPS redirect). The*.sslip.iohost resolves to your server IP, so the certificate issues automatically. Only then is the basic-auth / bearer-token protection meaningful.After deploy
Open the dashboard domain (user
admin, password from the generated env var) and configure a model provider key (e.g. Anthropic/OpenAI). The API bearer token is the generatedAPI_SERVER_KEYenv var.Validated locally with the repo's
validate-template.ts,validate-docker-compose.ts, andprocess-meta.js— all pass.🤖 Generated with Claude Code
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.