Install help

Linux host

Prepare a Linux host for Hermes onboarding.

Follow these steps before the install call when Hermes will run on a dedicated Linux workstation, mini PC, or server.

Time required: 20–30 minutes
Start guideOnboarding hub

Do these in order before install day

Complete as much as your policy allows. If a step is blocked, note who can approve or unblock it during onboarding.

Step 1

Choose a maintained Linux host

Use a supported, maintained distribution such as Ubuntu LTS or Debian stable unless we have agreed on another target. Tell us if the host runs other production services that cannot be restarted.

Step 2

Confirm sudo and home directory access

Confirm the account used for setup can run sudo and create files in its home directory. Keep credentials in your password manager or internal vault.

Step 3

Patch packages and reboot if needed

Install all pending security and package updates, then reboot if the kernel or core services changed. Check disk space and memory so package installation and logs do not fail mid-setup.

Step 4

Prepare network and SSH posture

Keep the machine on reliable power and a trusted private network. Confirm SSH access only if we ask for it, use scoped keys, and remove temporary access at handoff unless ongoing support requires it.

Step 5

Document blockers before the call

Document any corporate firewall, endpoint security, outbound proxy, or package repository restrictions that could block installation.

Useful checksuname -adf -hfree -hsudo apt update && sudo apt upgrade -y

Bring the right owner and approvals

OS readiness is only half the install. We also need account owners, MFA, and access boundaries available during the call.

Account readiness

  • Decide which always-on computer will host Hermes. Keep it on reliable power, a trusted private network, and at the location where it will normally operate.
  • Make sure the business owner or operator can approve access decisions and use an administrator account during the call.
  • Keep MFA devices, password manager access, approved accounts, and off-limits systems ready. Do not send passwords, private keys, recovery keys, or tokens in chat or email.
  • Use a private, trusted network. Avoid hotel, airport, café, and conference Wi-Fi for install day.
  • Tell us before the call about device-management, firewall, VPN, antivirus, IP allowlisting, or vendor-review constraints.

Platform notes

  • If this host runs other production services, tell us what cannot be restarted before the call begins.
  • Keep credentials in your password manager or internal vault; do not paste private keys or tokens into support threads.

What we will walk through together

  1. Confirm scope, owner, machine, and access boundary.
  2. Verify OS, network, shell, package manager, and remote access posture.
  3. Install and configure Hermes on your infrastructure.
  4. Connect approved accounts and integrations through secure OAuth or password-manager flows.
  5. Run supervised test workflows with clear approval gates.
  6. Document operating commands, recovery notes, and the handoff checklist.

Hermes launches under supervision

Legacy OpenClaw support is diagnostic-only unless explicitly scoped. The legacy path is ~/.openclaw/. No alternate legacy directory applies.

Need a different OS guide?

macOS workstation

macOS

Follow these steps before the install call when Hermes will run on a Mac mini or another dedicated macOS machine.

Open macOS guide →

Windows 11 + WSL2

Windows

Follow these steps before the install call when Hermes will run inside Ubuntu on WSL2.

Open Windows guide →
🦞Setup help

Blocked?

Ask before the call.

Fresh installs use Hermes. Never paste passwords, keys, recovery codes, or tokens.

Ask a setup questionReturn to Hub