Tailscale

1.5. Tailscale — A Private Network Without Open Ports

Its role in the infrastructure picture

Tailscale builds a WireGuard-based mesh VPN between your VPS and your devices. The VPS does not need any public inbound ports at all — this is the network layer that should be in place before you configure the Hermes dashboard or API server in chapter 2, because how those services bind their address (loopback, Tailscale IP, or 0.0.0.0) depends on whether Tailscale is already ready.

Notes

• Do not use any form of dashboard authentication bypass — Hermes has removed this shortcut; always pair Tailscale with a real authentication provider (Basic Auth for a trusted network, OAuth/OIDC for wider access). The concrete configuration is in chapter 2.
• If you plan to connect multiple MCP clients to the agent on the VPS, the recommended path is the Tailscale IP with a scoped token — far more stable than keeping a live SSH session around.
• Install Tailscale and confirm device-to-device connectivity before fully closing public SSH in 1.3 — reversing the order is the most common way to lock yourself out of the VPS.