Show HN: Fleet – a local-first console for managing Dockerized Hermes AI Agents

Fleet, a local-first web console for managing Dockerized Hermes AI agents, has been released as an open-source tool. It enables operators to create, configure, monitor, and operate Hermes and Nemo Hermes agents across trusted machines from a single dashboard. The tool keeps runtime state and secrets local by default, supporting features like service health monitoring, chat sessions, and backups.

Fleet is a local-first web console for creating, configuring, monitoring, and operating Dockerized Hermes agents across one or more trusted machines. It is primarily built for Hermes Agent and the NVIDIA-focused Hermes variant, Nemo Hermes. Standard Hermes agents are the default path; Nemo Hermes agents are supported when the nemohermes runner is available or automatic installation is enabled. It gives a single operator view for the parts that become noisy once you run more than one agent: service health, provider defaults, shared credentials, chat sessions, browser sidecars, VNC, terminal access, local web publishing, backups, restores, clones, remote nodes, and setup readiness. Fleet is designed for technical operators running personal or team-controlled agent infrastructure on a workstation, homelab, VPN, or trusted LAN. Runtime state and secrets stay local by default; the repository keeps source code separate from .env , runtime/ , data/ , logs/ , secrets/ , and vendor/hermes-agent/ . - Creates Hermes Docker agents from a repeatable local baseline. - Creates Nemo Hermes sandbox agents when the nemohermes runner is available or auto-install is enabled. - Coordinates local agents and trusted remote Fleet nodes from the same dashboard. - Shows agent state, service counts, health, memory readiness, gateway diagnostics, drift, and update status. - Opens agent chat, session history, dashboard, VNC, local web preview, and container terminal surfaces. - Saves fleet-wide provider defaults for OpenAI Codex, Ollama, Custom endpoints, and OpenRouter. - Stores shared provider credentials in ignored local files and syncs them into selected agents. - Supports Codex device login and controlled sync of Codex auth state into agents. - Creates Telegram-enabled agents through the onboarding pairing flow. - Publishes static files from each agent workspace through a per-agent webhost sidecar. - Backs up, restores, and clones agents while excluding secrets unless an operator explicitly opts in. - Runs release and setup audits that keep runtime state, tokens, logs, and oversized source files out of git. - Node.js 20+ and npm 10+ - Docker with Docker Compose v2 - git, when Fleet should clone the default Hermes source checkout automatically - Optional: nemohermes on PATH for Nemo Hermes sandbox agents The onboarding screen checks these requirements. From a terminal, run the same check with: npm run init:baseline npm run setup npm start Open: http://127.0.0.1:5180 npm run setup prepares ignored runtime folders, creates .env when missing, fixes executable bits on wrapper scripts, installs npm dependencies when needed, clones the configured Hermes source when it is missing, and runs the baseline check. New env files bind the console to 0.0.0.0 so trusted LAN machines can reach it, and setup prompts for or generates HERMES CONSOLE TOKEN because LAN-visible consoles must use API auth. npm start runs the baseline check, builds the frontend, and serves the production app from the Express server. From the console host itself, open http://127.0.0.1:5180 . From another trusted LAN machine, open http://<console-lan-ip :5180 and enter the console token when prompted. To keep Fleet local-only, set HERMES CONSOLE HOST=127.0.0.1 in .env . For active development: npm run dev The API runs on http://127.0.0.1:5180 ; the Vite frontend runs on http://127.0.0.1:5200 and proxies /api to the API server. In dev mode, Vite listens on 0.0.0.0 by default so LAN clients redirected by the API can reach the frontend; set HERMES CONSOLE DEV HOST=127.0.0.1 for local-only development. - Run npm run setup . - Open http://127.0.0.1:5180 . - Review setup checks on the onboarding screen. - Open Fleet settings and choose a provider default. - Add shared credentials or complete Codex device login if your selected provider needs auth. - Create an agent from the dashboard. - Open the agent detail view for chat, lifecycle, gateway, terminal, crons, credentials, and diagnostics. By default, Fleet clones Hermes source into vendor/hermes-agent from HERMES AGENT REPO URL . To use a checkout somewhere else, set: HERMES AGENT SRC=/path/to/hermes-agent To disable automatic source download: HERMES AGENT AUTO CLONE=0 Documentation index /matt454/agent-fleet-console/blob/main/docs/index.md Getting started /matt454/agent-fleet-console/blob/main/docs/getting-started.md Operator guide /matt454/agent-fleet-console/blob/main/docs/operator-guide.md Configuration reference /matt454/agent-fleet-console/blob/main/docs/configuration.md API reference /matt454/agent-fleet-console/blob/main/docs/api-reference.md Codebase guide /matt454/agent-fleet-console/blob/main/docs/codebase.md Implementation patterns /matt454/agent-fleet-console/blob/main/docs/patterns.md Release checklist /matt454/agent-fleet-console/blob/main/docs/release-checklist.md Security policy /matt454/agent-fleet-console/blob/main/SECURITY.md Contributing guide /matt454/agent-fleet-console/blob/main/CONTRIBUTING.md Support guide /matt454/agent-fleet-console/blob/main/SUPPORT.md npm run setup prepare local runtime state and dependencies npm start build and serve the production console npm run dev run API and Vite dev server npm run init:baseline check local setup readiness npm run check TypeScript type check npm test run node test suite npm run build production frontend build npm run audit:release repository hygiene audit npm run release:check full release gate npm run knip unused-code audit Fleet also includes repo-local wrappers: bin/hermes-console bin/hermes-docker status <agent bin/hermes-docker logs <agent bin/hermes-docker shell <agent bin/hermes-docker restart <agent bin/hermes-docker update <agent bin/hermes-docker delete <agent Use the UI for normal operation. Use the wrappers when you need a direct terminal escape hatch for local Docker agents. Fleet reads process env first, then these files when present: runtime/.env .env HERMES CONSOLE ENV FILE <HERMES INSTANCES ROOT /.env when HERMES INSTANCES ROOT is external Existing process environment variables win over .env values. If a shell profile, service manager, or launchctl export still sets HERMES CONSOLE HOST=127.0.0.1 , Fleet will stay loopback-only even when .env says 0.0.0.0 . The most important local settings are: HERMES INSTANCES ROOT=./runtime HERMES DOCKER BIN=./bin/hermes-docker HERMES AGENT SRC=./vendor/hermes-agent HERMES AGENT AUTO CLONE=1 HERMES CAMOFOX CONTEXT=./docker/camofox HERMES WEBHOST CONTEXT=./docker/webhost HERMES CONSOLE HOST=0.0.0.0 HERMES CONSOLE PORT=5180 HERMES CONSOLE DATA DIR=./data HERMES CONSOLE SECRETS DIR=./secrets HERMES CONSOLE REQUIRE AUTH=1 For a remote Fleet node, the base URL entered in Fleet settings - Fleet nodes should use the remote machine's LAN address, for example http://192.168.3.232:5180 , plus the same bearer token stored in that remote node's .env . Fleet-wide provider defaults and shared credentials are managed from Fleet settings and stored in ignored files: secrets/global-provider.json secrets/global-credentials.env secrets/global-oauth/ secrets/global-sync.json Per-agent config lives under each agent folder: <agent / home/ .env config.yaml SOUL.md workspace/ HERMES WEB.md web/ instance.env compose.yaml See Configuration reference /matt454/agent-fleet-console/blob/main/docs/configuration.md for the full environment and storage guide. Fleet binds to 0.0.0.0 by default so trusted LAN Fleet nodes can reach it. Keep API auth enabled and set: HERMES CONSOLE TOKEN=<long-random-token HERMES CONSOLE REQUIRE AUTH=1 The server refuses non-loopback binds unless HERMES CONSOLE TOKEN is set. npm run setup prompts for or generates a token when LAN binding or required auth needs one. For local-only use, set HERMES CONSOLE HOST=127.0.0.1 . Treat Fleet as a control plane. It can start and stop containers, open terminals, sync credentials, restore backups, create agents, proxy remote node actions, and optionally run self-update commands. Keep individual Hermes dashboards, Camofox VNC endpoints, and agent webhosts private unless you intentionally protect and expose them. Fleet Nodes let one console coordinate other Fleet consoles on trusted machines. Add remote consoles in Fleet settings - Fleet nodes with a label, base URL, optional bearer token, and enabled state. The dashboard then merges local and remote agents, shows the host for each row, and routes create, start, stop, restart, update, delete, clone, backup, chat, gateway, terminal, and detail actions through the selected node. Remote node bearer tokens are redacted in API responses but stored locally in data/fleet.db ; keep data/ private and use disk encryption on shared machines. Fleet writes backups to: data/backups/ Backups include agent config, selected workspace files, provider defaults, and a manifest. Secrets such as home/.env , global credentials, OAuth state, token-like files, and generated runtime secrets are excluded unless an operator explicitly enables secret export. Restore uses a local .tar.gz archive path on the console host. Restored agents receive fresh generated ports and runtime secrets. Clone duplicates a local agent into a new name and can optionally include workspace files and local per-agent credentials. bin/ fleet wrapper scripts used by the app docker/camofox/ Camofox sidecar image context docker/webhost/ Node.js static webhost sidecar image context server/ Express API, services, SQLite, terminal websocket src/ React frontend, UI state, styles, shared models scripts/ setup, baseline, release audit, dev/start orchestration docs/ user, operator, API, and maintainer documentation runtime/ ignored default Hermes instance root data/ ignored SQLite database and local control state logs/ ignored local process logs secrets/ ignored global provider credentials and OAuth state vendor/hermes-agent/ ignored optional Hermes source checkout/package Before publishing or opening a pull request: npm run release:check git status --short For setup, onboarding, Docker, or environment changes, also run: npm run init:baseline -- --json The release gate runs type checking, tests, production build, repository hygiene audit, production dependency audit, and unused-code audit. See Release checklist /matt454/agent-fleet-console/blob/main/docs/release-checklist.md for the manual review list.