Al Matty

Building Soma: a local-first health data pipeline that turns lab PDFs into an agent-readable knowledge base, so personal biology can be tracked like a codebase.

[Al Matty @almattydotcom]

Inside the container: the agent + Claude Code for coding. On the host (outside the container): another Claude Code for infra work. So, a container boundary: Clean permission split. SSH’ed in I canmanually run ‘outside Claude‘ with sudo permissions. Hermes can‘t.

[Al Matty @almattydotcom]

My Hermes Agent setup:

Hetzner CX43, SSH only, root off, fail2ban.
3 Docker containers:
Hermes,
Dashboard,
Camofox.
Syncthing bridges files to my Mac. WireGuard tunnel to my home router for a residential browser IP.

https://t.co/FkGVzWrGE4

[Al Matty @almattydotcom]

@Teknium @catalinmpit I do love the Camofox integration though. I wire it through my home router, too:

https://t.co/FkGVzWrGE4

[Al Matty @almattydotcom]

@Teknium @catalinmpit No easy hermes CLI access ( docker compose exec [--user] …). Aliases work, but upstream changes (like yesterday's s6 uid contract break) requires work again.

Cont. restart has led to permission drift for me (use an ACL watcher to keep important perms stable across restarts.

[Al Matty @almattydotcom]

@catalinmpit -SSH key only, root disabled, fail2ban on sshd
-Docker: Hermes in container, secrets/config outside
-for browser taksl/stealth: Camofox & route traffic via WireGuard → home router (residential IP)

My setup:
https://t.co/FkGVzWrGE4

[Al Matty @almattydotcom]

@_ReverseAI_ @AlexFinn @MichaelHyatt @Hermes_agentAI @gregisenberg @NetworkChuck Got it, but it's not only a firewall. You just use Linux, deactivate the root user, deactivate password login, then only your SSH can access it. So not really that open to the internet. Not any more online than your local agent, don't you think? Cloud is real though.

[Al Matty @almattydotcom]

@bradmillscan @bradmillscan or ask your agent to help you set up some weekly workspace file cleanup job looking for clutter & contradictions like this one. Although I find I need less hands-on things like that for Hermes than I needed with OpenClaw:
https://t.co/iB7NB9jtwj

[Al Matty @almattydotcom]

@bradmillscan Then version-control at LEAST config.yaml, SOUL.md, USER.md. git diff the changes from time to time to spot clutter or contradictions.
https://t.co/V9lnpPUx4w

[Al Matty @almattydotcom]

@_ReverseAI_ @AlexFinn @MichaelHyatt @Hermes_agentAI @gregisenberg @NetworkChuck Care to elaborate about 'the security aspect' that you somehow don't have to worry about locally? I mean, maybe my use case is just different since my agent has is own accounts, not mine. But so far I'm not convinced about some magical local setup quality.

[Al Matty @almattydotcom]

@KaiXCreator Team trying everything to make GPT feel like Claude: https://t.co/V9lnpPUx4w

[Al Matty @almattydotcom]

@AlexFinn @MichaelHyatt @Hermes_agentAI @gregisenberg @NetworkChuck Just not true. Put in the effort & get it to run on a VPS properly - inside a Docker container: https://t.co/V9lnpPUx4w

[Al Matty @almattydotcom]

@MichaelHyatt @Hermes_agentAI @gregisenberg @AlexFinn @NetworkChuck VPS. Also it doesn't need to be the only thing running on there. Inside Docker for security. Don't shy away from customizing: https://t.co/V9lnpPUx4w

[Al Matty @almattydotcom]

@_ReverseAI_ @AlexFinn @MichaelHyatt @Hermes_agentAI @gregisenberg @NetworkChuck Works perfectly fine. Just need to put some thought into it & set up properly: https://t.co/V9lnpPUx4w

[Al Matty @almattydotcom]

@Yaw_nyame35 That's not just a post. That's GPT 5.5.

[Al Matty @almattydotcom]

@itsolelehmann "Run GPT 5.5 with DeepSeek V4 Flash as a fallback" This post has been perfectly timed, just as I hit my Codex weekly limit 3 days in. Already amazed at DeepSeek's value for money as 2nd model.

[Al Matty @almattydotcom]

@rileybrown One thing that helps is stopping the natural workspace file growth [and automate it with a skill]:
https://t.co/bJqLarVVuz

[Al Matty @almattydotcom]

Full details of the workflow here:
https://t.co/dTnhPYmlde

[Al Matty @almattydotcom]

Full details of the workflow here:
https://t.co/dTnhPYmlde

[Al Matty @almattydotcom]

For those wondering why your OpenClaw agent gets dumber over time, like a Windows install, fix by keeping the growth of your workspace files in check:

[Al Matty @almattydotcom]

If a compaction removes too much, I can ask the agent to compare the current files to the last good state and suggest what to restore. He then happily diffs away & knows exactly what changed, and what the last 'good' state was.