NOOB2ROOT

Blog 21 Sept 2026 — 8 min

Running Hermes Agent on a Raspberry Pi for Under US$10 a Month (OpenRouter + DeepSeek)

Self-host Nous Research's Hermes Agent on a Raspberry Pi 4, talk to it from Telegram, and power it with DeepSeek through OpenRouter on a hard-capped budget.

raspberry-pi ai-agents hermes openrouter deepseek telegram homelab

Hermes Agent installed on a Raspberry Pi, pushing a notification to Telegram

#Why I did this

I wanted a personal AI agent that is always on, lives on hardware I own, and that I (and my household) can talk to from Telegram. Hermes Agent from Nous Research fits that perfectly: it's open source, it runs happily on a Raspberry Pi 4, it has a built-in Telegram gateway, and it can schedule tasks, remember context between sessions, and run commands on the box it lives on.

If you're wondering what an agent harness actually is, or why I picked Hermes over OpenClaw, click the name above. Tools and ideas in this post link to the Field Guide, so the post can stay about the build.

The catch is the model behind it. I started on a paid subscription, cancelled it, then tried a free tier. The free tier gave me roughly one message a day before hitting its limit, which is useless for an agent. The fix was pay-as-you-go through OpenRouter with a cheap but capable model: DeepSeek V4.1 Flash.

#What you get out of this setup

  • Cheap and capped. You prepay credits and set a hard limit on the API key. No surprise bills. My usage (two people chatting daily plus a nightly scheduled job) comes to a few US dollars a month.
  • No lock-in. One OpenRouter key gives you hundreds of models. If DeepSeek stops suiting you, you switch with a single command.
  • Always on. The Pi sips power, so the agent is reachable 24/7 via Telegram from anywhere.
  • Your box, your rules. The agent runs on your own hardware, and you decide what it can touch.

#What you need

  • Raspberry Pi 4 (4 GB is plenty). Boot from a USB SSD if you can; SD cards are the #1 way Pi projects die.
  • Raspberry Pi OS 64-bit (I'm on the Debian 13 "Trixie" based release)
  • A Telegram account
  • A card for OpenRouter (US$5 is enough to start)

#Step 1: Prepare the Pi

#Update everything

sudo apt update && sudo apt full-upgrade -y

#Make sure the hostname resolves

If sudo ever complains unable to resolve host <name>, your hostname is missing from /etc/hosts. Check and fix:

hostname
grep 127.0.1.1 /etc/hosts

# If the name there doesn't match your hostname:
sudo sed -i '/^127\.0\.1\.1/d' /etc/hosts
echo "127.0.1.1    $(hostname)" | sudo tee -a /etc/hosts

#Give the Pi a static IP

Optional for Hermes alone, but essential if you'll follow Part 2 and run DNS on the Pi. Raspberry Pi OS manages networking with NetworkManager, so everything here goes through nmcli.

Find your connection name and router (gateway):

nmcli -t -f NAME,DEVICE con show
ip route | grep default

Set the static address (replace the IPs with your own network's):

sudo nmcli con mod "Wired connection 1" \
  ipv4.method manual \
  ipv4.addresses 192.168.1.213/24 \
  ipv4.gateway 192.168.1.254 \
  ipv4.dns "1.1.1.1"
sudo nmcli con up "Wired connection 1"

ip -4 addr show eth0 | grep inet   # should show your IP with no "dynamic"

Pick an address outside your router's DHCP pool (or shrink the pool in the router's LAN settings), so the router never hands the same IP to another device.

If the Pi is wired, switch Wi-Fi off. Two IPs on the same network causes confusion later:

sudo nmcli radio wifi off

#Install Tailscale for remote access

You will want to reach this Pi when you're not at home — to check on the agent, restart the gateway, or fix something that broke. The old answer was to forward port 22 on your router. Don't. An SSH port exposed to the internet starts collecting credential-stuffing attempts within minutes of going live, and now it's guarding a box that runs shell commands on request.

Tailscale is the better answer: a WireGuard mesh VPN that lets your laptop and phone reach the Pi from anywhere, with every port on your router still closed. The guide entry explains how it works and why it beats port forwarding.

Install it on the Pi:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
sudo tailscale set --accept-dns=false   # stop Tailscale rewriting the Pi's own DNS
tailscale ip -4                          # your Pi's tailnet IP

sudo tailscale up prints a URL — open it in a browser, sign in, and the Pi joins your tailnet. Then install the client on your laptop and phone, sign in with the same account, and they can all reach each other.

That --accept-dns=false matters more than it looks. By default Tailscale takes over the device's DNS settings, which is fine on a laptop and wrong on a Pi that is about to be your DNS server in Part 2. Set it now and save yourself a confusing evening later.

#Step 2: Set up OpenRouter

  1. Sign up at openrouter.ai and add US$5 of credits.
  2. Go to Keys → Create key, and set a credit limit on the key (I used $5). This is your hard spending cap.
  3. Copy the key. You only see it once.

#Why DeepSeek V4.1 Flash?

Hermes is token-hungry on the input side. Every turn it sends the model its system prompt, the full list of tool definitions, recent chat history, and any files it opened. The output is usually small: a short reply and a tool call or two. So the input price is what drives your bill.

At the time of writing (September 2026), DeepSeek V4.1 Flash on OpenRouter costs around US$0.12 per million input tokens and US$0.48 per million output tokens, and it's designed for agent and tool-calling workloads.

Rough maths: about 20k input tokens per message comes to roughly US$0.002–0.003 per message. Even at 30 messages a day, that's about US$2–3 a month, and repeated tool definitions get cheaper still thanks to caching. Check the model's current price on OpenRouter before you commit, because prices move.

Plan B: if DeepSeek ever fumbles tool calls for you, Gemini Flash models are very reliable at tool use, but cost several times more per token.

#Step 3: Install Hermes Agent

Download the installer and read it before running it (you're piping a script into your shell, after all):

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh -o hermes-install.sh
less hermes-install.sh      # q to quit
bash hermes-install.sh
source ~/.bashrc

#Point it at OpenRouter + DeepSeek

hermes model
  • Choose OpenRouter
  • Paste your OpenRouter API key
  • Pick DeepSeek V4.1 Flash from the list (type deepseek to filter)

Lock down the file holding your keys, then run the built-in health check:

chmod 600 ~/.hermes/.env
hermes doctor

Quick test in the terminal:

hermes

Say hi, confirm it answers, then exit.

#Step 4: Connect Hermes to Telegram

#Create the bot

  1. In Telegram, message @BotFather (the official one with the blue tick) and send /newbot.
  2. Give it a display name, then a username ending in bot.
  3. BotFather replies with a bot token like 1234567890:AAH.... Treat it like a password: anyone holding it controls your bot.
  4. Find your own numeric Telegram user ID (for example, by messaging @userinfobot). You'll use it to restrict who can talk to your agent.

#Configure the gateway

hermes gateway setup

Choose Telegram, paste the bot token, and when asked who's allowed to use it, restrict it to your user ID (plus anyone in your household you want to allow). An agent with shell access on your Pi should not answer strangers.

Start it:

hermes gateway start

Now open your bot in Telegram, press Start, and send it a message.

#Keep it running after reboot

Check whether your Hermes version has a built-in service option first (hermes gateway --help). If it does, use that. If not, a systemd user service does the job:

which hermes    # note the full path, e.g. /home/pi/.local/bin/hermes

mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/hermes-gateway.service <<'EOF'
[Unit]
Description=Hermes Agent Telegram gateway
After=network-online.target

[Service]
ExecStart=%h/.local/bin/hermes gateway start
Restart=always
RestartSec=10

[Install]
WantedBy=default.target
EOF

# Adjust ExecStart if `which hermes` showed a different path
systemctl --user daemon-reload
systemctl --user enable --now hermes-gateway
sudo loginctl enable-linger "$USER"   # keep user services running when you're logged out
systemctl --user status hermes-gateway --no-pager

#Step 5: Keep an eye on spend

  • After a day or two, open Activity in the OpenRouter dashboard to see your real per-day cost.
  • The key's credit limit is your safety net: when it's used up, Hermes simply stops answering until you top up. There's no overage.
  • Switching models later is just hermes model again (or /model in chat).

#Security notes (read these)

Hermes can run commands on the Pi. Treat it like any other privileged service:

  • Restrict the Telegram bot to known user IDs only.
  • Keep command approval on for anything destructive. Hermes can ask before running commands; don't turn that off casually.
  • Protect secrets: chmod 600 ~/.hermes/.env, and never post screenshots showing your bot token or API key. If you leak a bot token, revoke it: BotFather → /mybots → your bot → API Token → Revoke.
  • Beware prompt injection. Anything Hermes reads (web pages, files, logs) can contain instructions written by someone else. Don't point it at untrusted text while it has tool access. In Part 2 I show how I feed it only sanitised data.
  • Cap the budget with the per-key credit limit on OpenRouter.

#Troubleshooting

Symptom Fix
sudo: unable to resolve host ... Add 127.0.1.1 <hostname> to /etc/hosts (Step 1)
Hermes answers once, then stops You hit a free-tier or credit limit. Check the OpenRouter balance and key limit
Bot doesn't respond on Telegram Is the gateway running? systemctl --user status hermes-gateway. Is your user ID on the allowed list?
Tool calls failing or looping Try another model via hermes model
Anything else hermes doctor

#What's next

With an always-on agent in Telegram, the fun starts. In Part 2 I turn the same Pi into a home-network security box: Pi-hole + Unbound for whole-house DNS filtering, an OpenCanary honeypot, Grafana + Loki as a lightweight SIEM, real-time Telegram alerts, and Hermes sending me a nightly summary.