Hermes Agent — Full Setup Guide

9.2 Funnel Watchdog Script

File: /home//.hermes/scripts/ensure_tailscale_funnel.sh

#!/usr/bin/env bash
# Checks BOTH Tailscale connectivity AND funnel route.
set -uo pipefail

TS=$(command -v tailscale || /usr/bin/tailscale)
HOST=$(hostname -s 2>/dev/null || hostname)

# Step 1: Check Tailscale is connected
if ! "$TS" status 2>&1 | grep -q "$HOST.*online"; then
  sudo -n "$TS" up 2>/dev/null || sudo "$TS" up
  sleep 5
fi

# Step 2: Check funnel route
STATUS=$("$TS" funnel status 2>&1)
if echo "$STATUS" | grep -q "/telegram proxy http://127.0.0.1:8443"; then
  echo "OK: /telegram funnel running"
  exit 0
fi

echo "FUNNEL DOWN -> attempting restart"
OUT=$(sudo -n "$TS" funnel --bg --set-path=/telegram http://127.0.0.1:8443 2>&1)
RC=$?
if [ $RC -eq 0 ] && echo "$OUT" | grep -vq "Access denied"; then
  echo "RESTARTED via sudo: $OUT"
  exit 0
fi
OUT2=$("$TS" funnel --bg --set-path=/telegram http://127.0.0.1:8443 2>&1)
RC2=$?
if [ $RC2 -eq 0 ] && echo "$OUT2" | grep -vq "Access denied"; then
  echo "RESTARTED (no sudo): $OUT2"
  exit 0
fi
echo "COULD NOT RESTART"
exit 1

9.3 Hermes Cron Job — Funnel Watchdog

Runs every 5 minutes via Hermes internal cron system (no system crontab). Configured in /home//.hermes/cron/jobs.json:

{
  "id": "be5f0ae94275",
  "name": "Funnel Watchdog",
  "prompt": "Restart the Tailscale Funnel tunnel if it went down...",
  "no_agent": true,
  "script": "ensure_tailscale_funnel.sh",
  "schedule": { "kind": "interval", "minutes": 5 },
  "enabled": true,
  "deliver": "local"
}

10. Verification Checklist

After rebuilding, run these checks to confirm everything works:

11. Troubleshooting

12. Key File Inventory

These files contain the entire setup. Back them up to preserve the configuration: