# Deploy the separate Hermes Workspace command center Deploy the separate Hermes Workspace, capture its API token when xCloud shows it in full once, prepare DNS, then verify HTTPS and authenticated connection. Canonical: https://xcloud.host/use-cases/playbooks/hermes-workspace-console/ Published: 2026-10-01 · Updated: 2026-10-01 · Technical review: 2026-10-01 Evidence: Source reviewed; no production deployment test claimed Editorial owner: xCloud editorial Intent: Deploy an optional Hermes Workspace connected to an existing xCloud Hermes Agent For: administrator, team-owner ## Requirements and responsibilities - Assign a named team owner for this task and confirm that all needed service accounts, sources and data are within the approved scope. Never place credentials or private keys in agent prompts. Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/); [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) - Confirm the managed Hermes service is running and use only xCloud controls documented for this task; any upstream Hermes CLI, file or scheduled-job procedure needs an authorized operator and is not evidence of an xCloud panel feature. Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/); [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) ## Illustrative situation Illustrative scenario: an administrator needs a separate authenticated browser Workspace for the existing Hermes Agent and owns the domain and credentials. ## Choose the approach - Deploy a separate Workspace only when browser control is needed; keep using terminal/Telegram if the existing path is enough. Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/); [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) ## Dashboard and application procedure ### 1. Confirm the Workspace is needed **Where:** Hermes Agent dashboard and team owner **Permissions:** Hermes owner **Inputs:** Existing running Hermes Agent; user need for browser workspace **Action:** Confirm the desired browser-based workspace and that it is a separate optional deployment from the Hermes Agent. **Expected result:** The owner understands this adds a separate service. **Verify:** Confirm server/domain ownership and operational owner. **If it fails:** If a terminal or Telegram is sufficient, do not deploy an additional service. Capability: Review the task result and retain human control Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ### 2. Enable the API and create token **Where:** Hermes Agent dashboard → Workspace **Permissions:** Authorized Hermes administrator **Inputs:** API enablement and secure secret storage **Action:** Enable the API server and generate/rotate its API token. Capture the value when the dashboard shows it in full once and store it in the approved secret manager; never put it in chat or a guide. **Expected result:** The API is enabled and its full token is saved securely at the point xCloud reveals it. **Verify:** Verify the token was saved securely without copying it into a guide or chat. **If it fails:** If token capture is lost, rotate/regenerate using the documented flow rather than reusing a partial value. Capability: Operate documented Hermes controls in the xCloud dashboard Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ### 3. Prepare the Workspace hostname **Where:** Workspace setup → Domain & SSL / DNS provider **Permissions:** Domain/DNS administrator **Inputs:** Owned hostname and DNS access; optional Cloudflare route documented by xCloud **Action:** Set the intended custom hostname and configure its DNS record as documented. TLS is checked after Workspace deployment because the service must exist first. **Expected result:** DNS points the intended hostname to the Workspace destination. **Verify:** Check DNS resolution before deploying. **If it fails:** If the hostname is not resolving as intended, fix DNS before continuing. Capability: Operate documented Hermes controls in the xCloud dashboard Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ### 4. Deploy Workspace **Where:** Hermes Agent dashboard → Workspace **Permissions:** Authorized Hermes administrator **Inputs:** Configured API, token and domain; optional documented Docker image choice **Action:** Deploy the separate Workspace using the xCloud workflow and copy the generated access password into the approved secret store. **Expected result:** Workspace deployment completes and xCloud provides access details. **Verify:** Confirm deployment status and avoid sharing the password in plain text. **If it fails:** If deployment fails, inspect dashboard status/logs and avoid repeated installs until state is known. Capability: Operate documented Hermes controls in the xCloud dashboard Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ### 5. Validate HTTPS and authenticate **Where:** Workspace browser login → configured custom domain **Permissions:** Authorized Workspace user **Inputs:** Deployed Workspace URL, password and API connection **Action:** After deployment, use a fresh unauthenticated browser session to confirm the Workspace shows its authentication gate without revealing agent data. Then verify the hostname certificate over HTTPS, sign in with the Workspace password and confirm connection to the intended Hermes Agent. **Expected result:** The unauthenticated session is gated; authorized login succeeds over HTTPS and reaches the intended agent. **Verify:** Check the unauthenticated gate first, then certificate/hostname, then authenticated agent identity. **If it fails:** If TLS, login or API connection fails, keep access limited, rotate exposed credentials and correct the specific issue before use. Capability: Review the task result and retain human control Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ## Maintenance - Review Workspace users, domain/SSL state, API token ownership and password handling; rotate credentials when access changes. Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/); [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) ## Recovery decisions - If the token/password is lost or exposed, rotate/regenerate it through the documented Workspace controls and revalidate domain and authenticated access. Sources: [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/); [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) ## AI handoff Configure the needed provider, channel, credentials and permissions separately. This guide does not imply xCloud has preconfigured upstream tools or scheduled jobs. ### Supported scope - **Review the task result and retain human control** (app; manual): Human acceptance and follow-up; no external write is implied. Checkpoint: Verify the source/output and actual side effects before sharing or acting. Sources: [Hermes security guide](https://hermes-agent.nousresearch.com/docs/user-guide/security); [Hermes daily briefing tutorial](https://hermes-agent.nousresearch.com/docs/guides/daily-briefing-bot); [Hermes automate with cron patterns](https://hermes-agent.nousresearch.com/docs/guides/automate-with-cron) - **Operate documented Hermes controls in the xCloud dashboard** (dashboard; manual): Manual xCloud interface. Use only deployment, Providers, Channels, Workspace and Updates controls documented by xCloud; do not infer extra dashboard capabilities. Checkpoint: Confirm the intended Hermes server and current visible control before saving a change. Sources: [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/); [xCloud Telegram setup for Hermes](https://xcloud.host/docs/create-a-telegram-bot-and-connect-it-with-hermes/); [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) ### Copyable agent brief ```text After an authorized administrator completes Workspace setup, verify the unauthenticated access gate, hostname HTTPS, authenticated login and expected agent identity. Do not disclose the API token or password or change other agent settings. ``` ### Manual checkpoints - Workspace deployment and credential steps are manual xCloud dashboard actions. Confirm DNS before deploy, then test HTTPS and login after the service exists. - Review the task-specific acceptance check and inspect actual output, configuration or run history before relying on it. ## Feature coverage - **Documented Hermes task path** (covered): Steps identify whether an action uses documented xCloud controls, upstream operator configuration or human review. Steps: step-1, step-2, step-3, step-4, step-5 - **Task-specific acceptance check** (covered): The final step validates this guide’s stated result. Steps: step-5 ## Sources - [xCloud Hermes Workspace setup guide](https://xcloud.host/docs/how-to-set-up-hermes-workspace-with-xcloud/) — reviewed 2026-10-01 - [xCloud Hermes Agent deployment guide](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) — reviewed 2026-10-01 - [Hermes security guide](https://hermes-agent.nousresearch.com/docs/user-guide/security) — reviewed 2026-10-01 - [Hermes daily briefing tutorial](https://hermes-agent.nousresearch.com/docs/guides/daily-briefing-bot) — reviewed 2026-10-01 - [Hermes automate with cron patterns](https://hermes-agent.nousresearch.com/docs/guides/automate-with-cron) — reviewed 2026-10-01 - [xCloud Telegram setup for Hermes](https://xcloud.host/docs/create-a-telegram-bot-and-connect-it-with-hermes/) — reviewed 2026-10-01 ## Continue [Review xCloud Hermes deployment options](https://xcloud.host/docs/how-to-deploy-hermes-agent-with-xcloud/) - [Deploy Hermes and verify the first model-backed task](https://xcloud.host/use-cases/playbooks/hermes-first-model-chat/)