Hosting

AWS architecture

One EC2 controller contains Hermes, local tools, the synthetic lab and encrypted storage. The model provider and approved HTTPS targets are remote. Native subagents share this controller. — Native subagents and shell tools share the controller.Open full size Mermaid source

Part	Setup
Controller	`t3a.medium` · 2 burstable vCPU · 4 GiB RAM
Access	SSM; no inbound security-group rules
Dashboard	`127.0.0.1:9119`
Storage	24 GiB OS disk + retained encrypted 80 GiB data disk
Recovery	S3 archives and AWS Backup snapshots
Model	Bedrock IAM or ChatGPT/Codex OAuth

Hermes runs without sudo. Maintenance owns installs, backups and target registration. Aegra is not a runtime dependency.

One host is not a customer-isolated fleet. Use separate disposable workers for untrusted workloads. There is no multi-AZ failover; host loss requires recovery.

The public subnet provides outbound access without a NAT gateway. Public IPv4 is billed; SSM and model connections originate from EC2. IMDSv2 is required.