DatattentionAgent gateways, and what to lock down
Hermes-style gateways mix a chat API and a dashboard. Split those two jobs.
An agent gateway is a process that accepts chat-shaped HTTP, keeps some session state, and can call tools. Products in this family, including Hermes-style setups, often split a gateway port from a dashboard port. The usual numbers people copy from a README are 8642 for the API and 9119 for the dashboard. The numbers are not the point. The split is.
The API can sit behind a proxy with a token if other systems must call it. The dashboard is an admin interface. It belongs on localhost or behind a login you already operate, not on an open cloud port beside the API. A dashboard that can edit config is a way to change the token, the tools, and the model.
Treat tool access as a separate decision from chat access. A caller who can complete a chat prompt should not automatically be a caller who can invoke a shell tool. If the product blends those, put a proxy rule in front that allows only the chat route from the application network.
Session state is data. It can contain prompts, file paths, and tool results. Store it on a disk you back up on purpose, and do not put that disk on a public file listing. Rotate the gateway token when someone who had it leaves the team.
Write a one-page runbook: how to start it, which port is which, where the token lives, and how to stop it. Gateways fail in boring ways, and the runbook should be boring too.
On this host
The Hermes-style pair on this host is open. The API is port 8642 at POST /v1/chat/completions, model name hermes-agent, with no API key. The dashboard is port 9119. GET /api/status and GET /api/sessions answer there.
curl http://datattention.com:8642/v1/chat/completions \
-H 'Content-Type: application/json' \
-d '{"model":"hermes-agent","messages":[{"role":"user","content":"Hello"}]}'The full list of ports and paths is on the endpoints page.