Hermes on the Mac Studio, Telegram on my phone, about 40 containers around them. The workflows that actually run, step by step.
daily workflows
6
containers
40
scheduled runs
~1,000
open ports at home
0
Step 1 · On my phone
It starts on my phone
I write to Hermes in Telegram, in the topic for the job. Each topic is a persona with its own instructions and limits: the one that watches servers can’t deploy, the one that writes can’t publish.
Hermes9 topics · 2 members
GeneralHermes: Caddy config reloaded, all routes up
DevHermes: Picked up 5 TestFlight feedback itemsHermes is typing
ResearcherHermes: Notes fixed, the podcast is ready
WriterHermes: Draft for X is waiting for your OK
OrchestratorHermes: Already passed on to the agent
OperatorHermes: New test build sent to testers
SecretaryHermes: Saved. The PDF is archived
ManagerHermes: That was in the Secretary topic
DEV
Hands code to Claude Code. Never pushes without an OK.
OPERATOR
Runs my apps: health, users, subscriptions. Read-only.
RESEARCHER
Researches with sources, answers with a podcast.
MONITORING
Watches the Studio and the apps. Diagnoses only.
ORCHESTRATOR
Keeps several Claude Code agents busy.
WRITER
Drafts posts in my voice. Never publishes.
Reading is free. Logs, status, selects, git status.
Writing asks first. Restarts, installs, deploys.
2 sub-agents at most. One local model serves everything.
Step 2 · Hermes
Hermes picks it up
It runs on the Mac Studio, thinks with a local model, and reaches everything else through tools.
Telegram
Mattermost
Dashboard
Hermes AgentA persona per job · 31 skills · 12 scheduled jobs · asks before it changes anything
Models
Local by default, cloud when needed
Tools
Shell, browser, 5 MCP servers
Services
40 containers, 13 background services
Private, over my VPN only
Nothing listens on the internet
Public
This site, my apps, mobile builds
Step 3 · The jobs
Six jobs it does every day
Same pattern every time: a script gathers facts, the local model writes, Telegram delivers, anything risky waits for me.
Morning health report
Every day, 11:00
Hermes cron fires
A script measuresStudio and VPS: disk, memory, containers
Local model writesReads the numbers, never reruns checks
Report on TelegramMonitoring topic
Alerts that fix themselves
Always on
37 uptime checksGatus, update and page watchers
ntfySelf-hosted push
Telegram alertThrough a small bridge
Watchdog healsRestarts Docker if it hangs, every 2 min
AI magazine with a podcast
Every day, 10:00
Scan trendingHugging Face and GitHub
Pick and writeOnly what runs on this Mac
Local voice reads itVoxCPM2, synced transcript
Private pageBehind Caddy
Coding from my phone
A text or a voice note
Message to DEVText or voice
Transcribed on the MacParakeet, local
Hermes picks the project
Claude Code worksSeveral sessions, kept unblocked
Deploys after my OK
Daily security sweep
Every day, 11:30, read-only
Hermes cron fires
Scan VPS and app imagesCritical and high CVEs
Summarise
Summary on TelegramFixes nothing on its own
Shipping this site
bun run ship
Astro buildStatic pages, drafts stay local
Token from InfisicalFetched at deploy time
Wrangler deployTo a Cloudflare Worker
Search engines pingedIndexNow
Where's n8n? It runs, and both agents can build workflows in it through MCP, but today it only holds two test workflows. The daily jobs live in Hermes cron, because the agent can read the result and decide what to say.
Step 4 · Underneath
What runs underneath
Everything Hermes touches lives on the Studio. Inventory of 9 November 2026.
Docker containers
40in 26 projects
Background services
13
Private apps behind Caddy
44
Scheduled agent runs
~1,0006 failed
Containers by job, count
Business apps and CRM15Ops and monitoring9Identity and secrets5Comms and alerts4Dev databases4AI and automation3
Scheduled agent runs so far, runs
Studio watchdog850New Qwen model watch102AI magazine13Health report11Security scan107 other jobs12
Docker
Caddy
n8n
Ollama
Portainer
SearXNG
Mattermost
ntfy
changedetection
Homepage
Twenty CRM
Hugo
Postgres
S3 storage
Infisical
Pocket ID
Gatus
Dozzle
Step 5 · Privacy
How it stays private
Every private app has its own name under one private domain. None of them is reachable from the internet.
My phone or laptop
Over the VPNNo port open on the router
CaddyOne wildcard certificate, 44 names
Identity checkIs this one of my devices?
The appListening on the Mac only
Certificate via a DNS challenge on Cloudflare, so nothing has to reach in
Config in git, pulled and applied every 5 minutes
Infisical holds every token; nothing secret is in a repo
Unknown names get a 404, and a second machine alerts if the Studio dies
Step 6 · Other apps
How it reaches other apps
MCP servers and plugins let the agents use other software without glue code.