⚙ Hermes Infrastructure Audit

graphlab.info · VPS srv1632845 · 177.7.52.251 · June 3, 2026

READ-ONLY 2026-06-03 DeepSeek Pro 56 services running

Stack: DNS (graphlab.info → 177.7.52.251) → Caddy (TLS) → VONDER (proxy router on :10276) → 20+ backend services. All backends on localhost, Caddy handles public HTTPS, Tailscale for private access.

VPS: 96GB disk (68% used), Ubuntu 22.04, Linux 6.8.0, Hermes v0.15.1 (126 commits behind), 34 skill categories, 112 SKILL.md files.

User systemd: 2 gateways (omega + mirror) on ports 8643/3978. Platform integrations: Telegram, Discord, API server, webhooks, Teams.

📋 Table of Contents

01Architecture Summary 02Port Map 03Service Map 04Reverse Proxy Routing 05Problems & Risks 06Recommended Target Architecture 07Cleanup Plan 08Current Architecture Diagram 09Recommended Architecture Diagram

1. Architecture Summary

Ingress

Caddy (ports 80/443) — Let's Encrypt TLS

Edge Router

VONDER (:10276) — Python HTTP proxy server

Internal Network

localhost only (127.0.0.1) — except Caddy and SSH

Private Access

Tailscale (100.67.155.37) — 2 Macs, 1 iPhone connected

Firewall

UFW inactive. iptables: default DROP on INPUT, rule to block :8643 from non-Tailscale

Hermes Gateway

User systemd, omega profile, :8643 (API) + :8644 (webhooks) + :3978 (Teams)

Ingress Channels:

Channel	Port	Route	Auth
Caddy (graphlab.info)	80 → 443	→ VONDER :10276	Let's Encrypt
Caddy (vault.graphlab.info)	443	→ Vaultwarden :10273	Let's Encrypt
Tailscale SSH	22	→ Direct SSH	SSH key
WARP (Cloudflare)	—	Outbound tunnel (active)	Cloudflare
Cloudflared	—	Inactive — stopped	JWT token

Flow: User → graphlab.info:443 → Caddy (TLS termination) → localhost:10276 (VONDER) → path routing → backend :PORT

2. Port Map

Port	Process	Bind	Purpose
22	sshd	0.0.0.0	SSH — both IPv4 and IPv6
25	postfix/master	127.0.0.1	SMTP (local only)
80	caddy	*:80	HTTP redirect to HTTPS
443	caddy	*:443	HTTPS — graphlab.info + vault.graphlab.info
445	smbd	0.0.0.0	Samba file sharing
631	cupsd	0.0.0.0	CUPS printing service
2019	caddy	127.0.0.1	Caddy admin API
3001	node (uptime-kuma)	127.0.0.1	Uptime Kuma dashboard
3210	node (hermes-mod)	127.0.0.1	Hermes Mod — Skin Studio
3978	hermes (gateway)	0.0.0.0	Teams bot adapter
4422	sshd	0.0.0.0	Secondary SSH port
8643	hermes (gateway)	0.0.0.0	Hermes Gateway — API + messaging
8644	hermes (gateway)	0.0.0.0	Hermes Gateway — webhooks
8765	python3	127.0.0.1	Signs365 Pricing Engine
8777	python	0.0.0.0	WeatherBet Dashboard API
8787	python	127.0.0.1	Hermes WebUI
8795	uvicorn	127.0.0.1	Sentinel Political Intelligence Backend
8888	docker-proxy	127.0.0.1	SearXNG search (Docker)
9050	tor	127.0.0.1	Tor SOCKS proxy
9119	hermes (dashboard)	127.0.0.1	Hermes Dashboard
10272	node (HCI)	127.0.0.1	Hermes Control Interface (Vite)
10273	docker-proxy	127.0.0.1	Vaultwarden (Docker)
10276	python3 (VONDER)	127.0.0.1	VONDER — central proxy router
10278	python3	127.0.0.1	V3 SALVe Vectorizer
10281	python3	127.0.0.1	Print Broker Quote Engine
10282	python3 (Aether)	127.0.0.1	Aether Engine — trading analysis
10284	node	127.0.0.1	UA Dashboard (Understand Anything)
10285	ttyd	127.0.0.1	Web terminal (auth: kyle/terminal2026)
10286	filebrowser	127.0.0.1	File browser (noauth mode)
10287	uvicorn (TIB)	127.0.0.1	TIB original (INACTIVE)
10289	uvicorn (TIB3)	127.0.0.1	TIB3 — merged TIB dashboard
10290	vibe-trading	127.0.0.1	Vibe-Trading API Server
10291	uvicorn (TIB4)	127.0.0.1	TIB4 — TradingAgents collector
10292	python3	127.0.0.1	SIGN WORKS (Zak) Pricing
10293	python3	127.0.0.1	Aether Web CLI
10294	python3	127.0.0.1	Options Finder Dashboard
10295	python3	127.0.0.1	Options Accuracy Tracker

MEDIUM

Port 8777 (WeatherBet API) on 0.0.0.0

Exposed to the world without auth. Only proxied through VONDER/graphlab, but direct IP:port access is possible. Should bind to 127.0.0.1.

MEDIUM

Ports 8643, 8644, 3978 on 0.0.0.0

Gateway API, webhooks, and Teams bot all on 0.0.0.0. Rule #2 in iptables blocks non-tailscale0 :8643 traffic. But :8644 (webhooks) and :3978 (Teams) have no explicit iptables blocks. Webhooks on public IP is expected (needs to receive POST from services), but :3978 should also be locked down.

3. Service Map

Systemd Services — System Scope

Service	Port	Status	Backend/Notes
vonder-api.service	10276	ACTIVE	VONDER proxy — central router (Python ThreadingHTTPServer)
caddy.service	80, 443	ACTIVE	Caddy v2 — TLS + reverse proxy
hermes-control.service	10272	ACTIVE	Hermes Control Interface (Node Vite)
hermes-dashboard.service	9119	ACTIVE	Hermes Agent Dashboard (hermes --profile omega dashboard)
hermes-webui.service	8787	ACTIVE	Hermes Web UI (Python server)
hermes-mod.service	3210	ACTIVE	Hermes Mod — Skin Studio Web UI
aether.service	10282	ACTIVE	Aether Engine — trading analysis + brain
aether-cli.service	10293	ACTIVE	Aether Web CLI terminal
options-finder.service	10294	ACTIVE	Options Strategy Finder dashboard
options-tracker.service	10295	ACTIVE	Options Accuracy Tracker API
sentinel-backend.service	8795	ACTIVE	Sentinel Political Intelligence (FastAPI+SQLAlchemy)
vibe-trading.service	10290	ACTIVE	Vibe-Trading API + Swarm (MCP)
tib3.service	10289	ACTIVE	TIB3 — merged TIB dashboard (6 collectors)
tib4.service	10291	ACTIVE	TIB4 — TradingAgents collector
tib.service	10287	INACTIVE	TIB original — stopped, disabled (merged into TIB3)
weatherbot.service	—	ACTIVE	WeatherBet bot (Polymarket trading, no HTTP)
weatherbet-api.service	8777	ACTIVE	WeatherBet Dashboard API
print-broker-quote.service	10281	ACTIVE	Print Broker Quote Engine
zak-quote.service	10292	ACTIVE	SIGN WORKS (Zak) Pricing Calculator
signs365-pricing.service	8765	ACTIVE	Signs365 Pricing Engine
vectorizer-v3.service	10278	ACTIVE	V3 SALVe Vectorizer
filebrowser.service	10286	ACTIVE	File Browser (noauth)
ttyd.service	10285	ACTIVE	Web terminal
ua-dashboard.service	10284	ACTIVE	Understand Anything Dashboard
warp-svc.service	—	ACTIVE	Cloudflare WARP client

User Systemd Services

Service	Port	Status	Notes
hermes-gateway-omega.service	8643, 8644, 3978	ACTIVE	Main gateway — messaging, API, webhooks, Teams
hermes-gateway-mirror.service	—	ACTIVE	Mirror profile — silent observer

Docker Containers

Container	Image	Port	Status
searxng	searxng/searxng:latest	127.0.0.1:8888→8080	UP 3d
uptime-kuma	louislam/uptime-kuma:1	3001 (host)	UP 3d
vaultwarden	vaultwarden/server:latest	127.0.0.1:10273→80	UP 3d
discovery-dashboard-api-1	discovery-dashboard-api	—	UP 3d

Cron Jobs

Schedule	Command	Purpose
0 1 * * *	gbrain-dream-wrapper.sh	GBrain nightly digest
0 9 * * 0	bun run gbrain doctor	GBrain weekly health check
0 * * * *	hermes-sentinel	Sentinel update hourly
5 1 * * *	hermes-veritas	Veritas nightly verification
/5 * * *	duckdns/duck.sh	DuckDNS IP update
0 4 * * *	backup.sh (restic)	Restic backup

4. Reverse Proxy Routing

Caddy Routes

Domain/Path	Target	Type
graphlab.info /*	localhost:10276 (VONDER)	reverse_proxy
graphlab.info /terminal/*	localhost:10285 (ttyd)	reverse_proxy (direct)
graphlab.info /signworks/*	/root/signworks.html	static files
graphlab.info /socket.io/*	localhost:3001 (Uptime Kuma)	reverse_proxy (WebSocket)
vault.graphlab.info /*	localhost:10273 (Vaultwarden)	reverse_proxy

VONDER Proxy Routes (path → port)

Path	Target Port	Backend
/	:10276 (static)	graphlab-site/ index.html → landing page
/terminal/*	:10285	ttyd web terminal
/weatherbet/api/*	:8777	WeatherBet Dashboard API
/weatherbet-api/*	:8777	WeatherBet API (POST)
/files/*	:10286	File Browser
/sentinel*	:8795	Sentinel backend
/webhooks*	:8644	Hermes webhooks
/quote/*	:10281	Print Broker Quote
/zak/*	:10292	SIGN WORKS Pricing
/signs365/*	:8765	Signs365 Pricing
/webui/*	:8787	Hermes WebUI
/options2*	:10294	Options Finder
/brief*	:10294	Options Finder (brief view)
/brief/accuracy*	:10295	Options Tracker
/trading*	:10282	Aether Engine
/cli*	:10293	Aether Web CLI
/dashboard/*	:9119	Hermes Dashboard
/achievements*	:9119	Hermes Achievements plugin
/hci*	:10272	Hermes Control Interface (Vite SPA)
/tib3*	:10289	TIB3 Dashboard
/tib4*	:10291	TIB4 Dashboard
/tib* (301)	:10289	Redirect to TIB3
/tib2* (301)	:10289	Redirect to TIB3
/vibe*	:10290	Vibe-Trading
/uptime*	:3001	Uptime Kuma
/vectorize*	:10278	V3 Vectorizer
/api/stats, /api/gbrain, etc.	:10276	VONDER native endpoints
/api/* (catchall)	:8643	Hermes Gateway API
/banks/*	:9998	DEAD — port 9998 not listening
/hindsight*	:8887	DEAD — Hindsight was removed (replaced by OB1)
/fleming*	:9998	DEAD — port 9998 not listening

MEDIUM

Dead Routes in VONDER — /banks, /hindsight, /fleming

Three route prefixes proxied to ports/backends that no longer exist. /banks → :9998 (nothing listening), /hindsight → :8887 (Hindsight removed), /fleming → :9998. These should be cleaned up or serve 404s directly.

5. Problems & Risks

CRITICAL

UFW Inactive — No Firewall

UFW is completely disabled. The only protection is iptables rules: default DROP on INPUT with a single explicit block on :8643 from non-Tailscale sources. Ports 3978 (Teams), 8644 (webhooks), 8777 (WeatherBet), 445 (Samba), 631 (CUPS) are all accessible from 0.0.0.0. The box relies entirely on Caddy TLS and obscurity.

HIGH

Hermes Gateway 126 Commits Behind

v0.15.1 is installed but 126 commits behind upstream. This could miss bug fixes, security patches, and feature improvements. Run 'hermes update' to catch up (may trigger post-update hook for TUI overlay).

HIGH

WeatherBot Secrets in systemd Unit

Polymarket private key, IPRoyal proxy credentials, and Visual Crossing API key are all hardcoded as Environment= directives in the weatherbot.service unit file. Visible via 'systemctl cat weatherbot.service' to anyone with access. Should be moved to an EnvironmentFile.

HIGH

File Browser With No Auth

filebrowser.service runs with --noauth flag, bound to 127.0.0.1. While only accessible via VONDER proxy, anyone who can reach VONDER (anyone on the internet via graphlab.info/files) gets full file access. Should add auth or remove the public route.

HIGH

Dead /banks, /hindsight, /fleming Routes

Three routing prefixes point to ports that don't exist (9998, 8887). /hindsight was replaced by OB1. These routes should be removed from VONDER to prevent confusion.

MEDIUM

Old MacBook Air Still on Tailscale but Offline

Tailscale shows kyles-macbook-air (100.101.43.38, M3) as offline, last seen 1h ago. This machine was replaced by the M5 MacBook Pro. The Tailscale node should be expired.

MEDIUM

CUPS and Samba on Public Interface

CUPS (port 631) and Samba (port 445) are bound to 0.0.0.0. These are printer/file sharing services with no business being accessible from the public internet on a VPS. CUPS is especially concerning — bound to 0.0.0.0 with no firewall.

MEDIUM

WeatherBet API on 0.0.0.0

Port 8777 binds to all interfaces. While proxied through VONDER, direct IP:port access bypasses VONDER entirely. Should bind to 127.0.0.1 and change systemd --host directive.

MEDIUM

Disk at 68% (66/96GB)

/dev/sda1 is 66GB used out of 96GB. Hermes session store is 734MB, logs 26MB, skills 9.5MB. Accumulating session data and Docker image layers will continue growing. Monitor monthly.

LOW

DuckDNS Still Active

duck.sh cron runs every 5 minutes updating a DuckDNS record. This was likely used before graphlab.info was configured. Should be cleaned up if no subdomain is active.

LOW

vault.graphlab.info DNS Not Resolving

'dig +short vault.graphlab.info' returns empty. Caddy config and VONDER proxy both reference it, but no A record exists in DNS.

LOW

Cloudflared Service Installed but Inactive

cloudflared service is installed with a tunnel token but marked inactive. WARP (warp-svc) is active instead. Duplicate Cloudflare tooling — should pick one and clean up the other.

LOW

TIB Original Service Disabled But Still Wired

tib.service (original TIB on port 10287) is inactive/disabled but VONDER still has routes for /tib (301 to TIB3) and /tib2/api POST (→:10287). These work since the redirect never hits the dead backend, but the dead service should be cleaned up from VONDER.

6. Recommended Target Architecture

Enable UFW — allow only 22, 80, 443, tailscale0. Block everything else at the host level. This is the single biggest security win.
Bind all services to 127.0.0.1 — fix WeatherBet API (:8777 → 127.0.0.1), and confirm gateway webhooks/Teams don't need public bind (webhooks do need it for receiving POSTs).
Move WeatherBot secrets to EnvironmentFile — remove API keys and proxy credentials from systemd unit file.
Update Hermes Agent — catch up 126 commits. The TUI overlay hooks should survive a reset --hard.
Clean up dead VONDER routes — remove /banks, /hindsight, /fleming from proxy routing.
Remove dead services — TIB original (tib.service), Cloudflared, old MacBook Air Tailscale node.
Add vault.graphlab.info DNS record — point to 177.7.52.251.
Add auth to File Browser or remove public route — /files should not be accessible without auth.
Block CUPS and Samba at firewall level — these have zero reason to be on the public interface of a VPS.

7. Step-by-Step Cleanup Plan

Phase 1 — Security (15 minutes)

Enable UFW: allow 22, 80, 443, tailscale0 subnet, default deny incoming
Fix WeatherBet API bind: edit weatherbet-api.service to --host 127.0.0.1
Remove CUPS/Samba public exposure via UFW rules
Add UFW rule for tailscale0 interface: allow to any port

Phase 2 — Secrets & Hygiene (10 minutes)

Create /opt/weatherbot/.env with all secrets
Edit weatherbot.service: add EnvironmentFile= and remove inline Environment= lines
Reload systemd, restart weatherbot

Phase 3 — Dead Code Cleanup (10 minutes)

Remove /banks, /hindsight, /fleming routes from vonder_api.py
Disable cloudflared service if not needed
Remove DuckDNS cron if no active subdomain
Remove TIB original route from VONDER if no longer needed

Phase 4 — Hermes Update (15 minutes)

Verify TUI overlay restore.py works
Run 'hermes update'
Verify gateway restarted correctly on :8643
Run 'hermes status' to confirm all OK

Phase 5 — DNS & Verification (10 minutes)

Add A record for vault.graphlab.info
Expire old MacBook Air from Tailscale admin console
Curl all major public routes to ensure they still 200
Check weatherbot and health watchdog still healthy

8. Current Architecture Diagram

┌─────────────────────────────────────────────────────────────────────┐
│                         INTERNET                                     │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐              │
│  │ :80 → :443   │  │ Tailscale    │  │ SSHD         │              │
│  │ graphlab.info│  │ 100.67.155.37│  │ :22 / :4422  │              │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘              │
│         │                 │                 │                       │
└─────────┼─────────────────┼─────────────────┼───────────────────────┘
          │                 │                 │
          ▼                 ▼                 ▼
┌─────────────────────────────────────────────────────────────────────┐
│                         CADDY (TLS)                                 │
│  graphlab.info → 127.0.0.1:10276                                    │
│  vault.graphlab.info → 127.0.0.1:10273                               │
│  /terminal/* → 127.0.0.1:10285                                       │
│  /signworks/* → /root/signworks.html                                 │
│  /socket.io/* → 127.0.0.1:3001                                       │
└──────────────────────┬──────────────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    VONDER PROXY (:10276)                            │
│  Python ThreadingHTTPServer — path-based routing                    │
│                                                                     │
│  ┌──────────┬──────────┬──────────┬──────────┬──────────┐          │
│  │TRADING   │PRICING   │HERMES    │DATA      │DEAD      │          │
│  ├──────────┼──────────┼──────────┼──────────┼──────────┤          │
│  │:10282    │:10281    │:8643     │:10289    │:9998     │          │
│  │ Aether   │ Quote    │ Gateway  │ TIB3     │ /banks   │          │
│  │:10293    │:10292    │:9119     │:10291    │:8887     │          │
│  │ CLI      │ S.WORKS  │ Dashboard│ TIB4     │ /hindsight│         │
│  │:10290    │:8765     │:10272    │:10284    │:9998     │          │
│  │ Vibe-T   │ Signs365 │ HCI      │ UA       │ /fleming │          │
│  │:8777     │:10294    │:8787     │:10278    │          │          │
│  │ WxBet    │ OptFind  │ WebUI    │ Vector   │          │          │
│  │:10295    │:8795     │:3001     │:10286    │          │          │
│  │ OptTrack │ Sentinel │ Kuma     │ Files    │          │          │
│  └──────────┴──────────┴──────────┴──────────┴──────────┘          │
└─────────────────────────────────────────────────────────────────────┘
                       │
         ┌─────────────┼─────────────┐
         ▼             ▼             ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│  DOCKER      │ │  SYSTEMD     │ │  CRON        │
├──────────────┤ ├──────────────┤ ├──────────────┤
│ SearXNG:8888 │ │ weatherbot   │ │ gbrain 1AM   │
│ Vault:10273  │ │ hermes-ctrl  │ │ sentinel hrly │
│ Kuma:3001    │ │ hermes-dash  │ │ veritas 1AM  │
│ Discovery    │ │ aether       │ │ duckdns 5min │
│ (internal)   │ │ vibe-trading │ │ backup 4AM   │
│              │ │ options-find │ │              │
│              │ │ sentinel-bk  │ │              │
│              │ │ tib3/tib4    │ │              │
│              │ │ vectorizer   │ │              │
└──────────────┘ └──────────────┘ └──────────────┘

9. Recommended Architecture Diagram

┌──────────────────────────────────────────────────────────────────────┐
│                          INTERNET                                     │
│   ┌─────────────────┐   ┌─────────────────┐   ┌─────────────────┐   │
│   │ Caddy :80→:443  │   │ Tailscale SSHD  │   │ 0.0.0.0:8644    │   │
│   │ graphlab.info   │   │ 100.67.155.37   │   │ (webhooks only) │   │
│   │ vault.          │   │ port 22         │   │                 │   │
│   └────────┬────────┘   └────────┬────────┘   └────────┬────────┘   │
│            │                     │                      │            │
└────────────┼─────────────────────┼──────────────────────┼────────────┘
             │                     │                      │
             │               ┌─────┴─────┐                │
             │               │  UFW      │                │
             │               │ ALLOW:    │                │
             │               │ 22, 80,   │                │
             │               │ 443, ts   │                │
             │               └───────────┘                │
             ▼                                            │
┌──────────────────────────┐                             │
│    VONDER PROXY (:10276) │                             │
│  Clean routes — no dead  │                             │
│  paths                   │                             │
└─────────┬────────────────┘                             │
          │                                              │
          ▼                                              ▼
┌───────────────────┐  ┌─ ─ ─ ─ ─ ─ ┐  ┌───────────────────┐
│ ALL BACKENDS      │  │  REMOVED     │  │ HERMES GATEWAY   │
│ (127.0.0.1 only)  │  │             │  │ (:8643 local)     │
├───────────────────┤  │ /banks      │  │ (:8644 public)    │
│ Aether (:10282)   │  │ /hindsight  │  │ (:3978 locked)    │
│ Quote (:10281)    │  │ /fleming    │  └───────────────────┘
│ TIB3 (:10289)     │  │ DuckDNS     │
│ TIB4 (:10291)     │  │ Cloudflared │
│ Vibe (:10290)     │  │ Old Mac     │
│ WeatherBet (:8777)│   ─ ─ ─ ─ ─ ─ ┘
│ Signs365 (:8765)  │
│ Options (:10294)  │
│ Sentinel (:8795)  │
│ HCI (:10272)      │
│ WebUI (:8787)     │
│ Dashboard (:9119) │
│ Kuma (:3001)      │
└───────────────────┘

📋 Appendix: System Info

Hostname	srv1632845
OS	Linux 6.8.0-117-generic x86_64, Ubuntu
Public IP	177.7.52.251
Tailscale IP	100.67.155.37
Disk	96GB (66GB used, 68%)
Hermes Version	v0.15.1 (2026.5.29) — 126 commits behind
Hermes Profiles	omega, trader, mirror (3)
Skills	112 SKILL.md files in 35 categories
Gateways	2 user services (omega + mirror)
Docker	4 containers (SearXNG, Vaultwarden, Kuma, Discovery)
Firewall	UFW inactive — iptables with minimal rules
DNS	graphlab.info → 177.7.52.251 · vault.graphlab.info — no A record
Tailscale Nodes	VPS (Linux), iPhone, MacBook Air (offline), MacBook Pro (M5)

Report generated June 3, 2026 · Read-only audit · No changes made