feat: add Hermes agent template (#960)

Hermes is an open agent runtime from Nous Research. This template runs the
supervised gateway with:
- web dashboard (9119) behind Traefik, protected by the bundled basic-auth
  provider (auth-gated mode triggers automatically once reachable off-loopback);
  username admin, generated 128-char password
- OpenAI-compatible gateway API (8642), enabled and bound to 0.0.0.0 with a
  generated bearer token (both off by default upstream)

Image pinned to v2026.6.19. Provider keys are configured from the dashboard
after deploy and persist in the hermes_data volume.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

blueprints/hermes/docker-compose.yml

@@ -0,0 +1,27 @@
+version: "3.8"
+services:
+  hermes:
+    image: nousresearch/hermes-agent:v2026.6.19
+    restart: unless-stopped
+    command: gateway run
+    ports:
+      - 9119
+      - 8642
+    environment:
+      - HERMES_DASHBOARD=${HERMES_DASHBOARD}
+      - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=${HERMES_DASHBOARD_BASIC_AUTH_USERNAME}
+      - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=${HERMES_DASHBOARD_BASIC_AUTH_PASSWORD}
+      - HERMES_DASHBOARD_BASIC_AUTH_SECRET=${HERMES_DASHBOARD_BASIC_AUTH_SECRET}
+      - API_SERVER_ENABLED=${API_SERVER_ENABLED}
+      - API_SERVER_HOST=${API_SERVER_HOST}
+      - API_SERVER_KEY=${API_SERVER_KEY}
+    volumes:
+      - hermes_data:/opt/data
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+          cpus: "2.0"
+
+volumes:
+  hermes_data:

blueprints/hermes/template.toml

@@ -0,0 +1,33 @@
+[variables]
+dashboard_domain = "${domain}"
+gateway_domain = "${domain}"
+# base64 (not just alphanumeric); 96 bytes -> 128 chars
+dashboard_password = "${base64:96}"
+dashboard_secret = "${base64:32}"
+api_key = "${password:32}"
+
+[config]
+mounts = []
+
+# Web dashboard (HERMES_DASHBOARD=1). Exposed behind Traefik, so Hermes'
+# auth-gated mode kicks in — protect it with the bundled basic-auth provider.
+[[config.domains]]
+serviceName = "hermes"
+port = 9119
+host = "${dashboard_domain}"
+
+# OpenAI-compatible gateway API. Disabled and loopback-bound by default,
+# so it must be enabled, bound to 0.0.0.0, and given a bearer token.
+[[config.domains]]
+serviceName = "hermes"
+port = 8642
+host = "${gateway_domain}"
+
+[config.env]
+HERMES_DASHBOARD = "1"
+HERMES_DASHBOARD_BASIC_AUTH_USERNAME = "admin"
+HERMES_DASHBOARD_BASIC_AUTH_PASSWORD = "${dashboard_password}"
+HERMES_DASHBOARD_BASIC_AUTH_SECRET = "${dashboard_secret}"
+API_SERVER_ENABLED = "true"
+API_SERVER_HOST = "0.0.0.0"
+API_SERVER_KEY = "${api_key}"

meta.json

@@ -2970,6 +2970,24 @@
       "self-hosted"
     ]
   },
+  {
+    "id": "hermes",
+    "name": "Hermes",
+    "version": "v2026.6.19",
+    "description": "Hermes is an open agent runtime from Nous Research, exposing an OpenAI-compatible gateway API and a supervised web dashboard for building and running AI agents.",
+    "logo": "logo.png",
+    "links": {
+      "github": "https://github.com/NousResearch/hermes-agent",
+      "website": "https://hermes-agent.nousresearch.com/",
+      "docs": "https://hermes-agent.nousresearch.com/docs/user-guide/docker"
+    },
+    "tags": [
+      "ai",
+      "agent",
+      "llm",
+      "self-hosted"
+    ]
+  },
   {
     "id": "heyform",
     "name": "HeyForm",