connect any agent · verified end-to-end 2026-09-10

Hermes Agent Integration

The endpoint

Base URL
http://frame-serv-2:8080/v1  (tailnet MagicDNS — or http://100.126.153.18:8080/v1)
API
OpenAI-compatible: /v1/chat/completions, /v1/embeddings, tools/function-calling
Auth
API key required (Bearer) — issued out-of-band; firewall also restricts :8080/:18190 to tailnet 100.64.0.0/10
Rerank
http://frame-serv-2:18190/v1/rerank — POST {"query":…,"documents":[…]}
Model ids
qwen38-27b · flashnext-iq1s · glm53-flash · embed

Drop-in Hermes profile (working, verified)

Live on the operator's node at ~/.hermes/profiles/frameserv2/ — verified end-to-end ("ARISE" round-trip through hermes → tailnet → llama-swap → MTP inference):

~/.hermes/profiles/frameserv2/config.yaml
---
model:
  default: "qwen38-27b"
  provider: "custom:frameserv2"
  base_url: "http://100.126.153.18:8080/v1"
  api_key: "fs2-"
providers:
  custom:frameserv2:
    base_url: "http://100.126.153.18:8080/v1"
    model_prefix: ""
    api_key: "fs2-"

agent:
  max_turns: 60
  task_completion_guidance: true

display:
  personality: technical
  show_cost: false
  show_reasoning: false
  compact: true

Run it: hermes --profile frameserv2 · one-shot: hermes --profile frameserv2 -z "…"

Switch models by changing model.default to any of the model ids above — one endpoint, three brains:

Multiple profiles can share this endpoint with different personas (SOUL.md) — same pattern as zaraki/ishigami on ashborn-prime.

Plain OpenAI client (any agent framework)

from openai import OpenAI
client = OpenAI(base_url="http://frame-serv-2:8080/v1", api_key="not-needed")
r = client.chat.completions.create(
    model="qwen38-27b",
    messages=[{"role": "user", "content": "Hello"}],
)
print(r.choices[0].message.content)

Network reachability matrix

FromReachable?Path
Any tailnet device (dxverm tailnet)yesTailscale → firewalld rich-rule (100.64.0.0/10 scoped) → :8080/:18190
Friend's LAN (10.141.47.x)blocked by designfirewalld public zone has no 8080 rule for LAN sources
Public internetneverNo port-forward exists. Post-handback remote access method is the owner's choice (tunnel plan retired 2026-09-10)

Security posture: no API key — reachability IS the auth, and it's tailnet-scoped. If wider access is ever wanted, add llama-swap API-key middleware first (documented decision point in the change log).

Try it visually

The Model Playground (on the box, tailnet-only) runs one prompt against every model sequentially with live streaming — the fastest way to see the differences.

What this endpoint gives an agent

CapabilityModelsVerified
Chat + streamingallyes
Tool / function calling (OpenAI schema)qwen38-27b, flashnext-iq1s, llama-70b, dsv4yes
Vision (image input)qwen38-27b, flashnext-iq1syes
Embeddings (1024-dim)embedyes
Reranking:18190 (bge-reranker-v2-m3)yes
Toolsglm53-flashtext-form only — needs client-side parse or PR template fix