# Deploy a Private Hermes Agent on Render Securely with Pulumi, Modal, and Tailscale

DevFeed: [Deploy a Private Hermes Agent on Render Securely with Pulumi, Modal, and Tailscale](<https://devfeed.tech/articles/deploy-a-private-hermes-agent-on-render-securely-with-pulumi-modal-and-tailscale-18995.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/deploy-a-hermes-agent-with-pulumi/>)

Author: Engin Diri

Published: 2026-06-24T00:00:00Z

Content type: tutorial

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [hosting](<https://devfeed.tech/topics/hosting.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>), [Code](<https://devfeed.tech/topics/code.md>), [ui](<https://devfeed.tech/topics/ui.md>), [Messaging](<https://devfeed.tech/topics/messaging.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [building](<https://devfeed.tech/tags/building.md>), [code](<https://devfeed.tech/tags/code.md>), [hosting](<https://devfeed.tech/tags/hosting.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [modal](<https://devfeed.tech/tags/modal.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pulumi](<https://devfeed.tech/tags/pulumi.md>), [pulumi-esc](<https://devfeed.tech/tags/pulumi-esc.md>), [python](<https://devfeed.tech/tags/python.md>), [render](<https://devfeed.tech/tags/render.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosting](<https://devfeed.tech/tags/self-hosting.md>), [server](<https://devfeed.tech/tags/server.md>), [services](<https://devfeed.tech/tags/services.md>), [tailscale](<https://devfeed.tech/tags/tailscale.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [ui](<https://devfeed.tech/tags/ui.md>)

## AI overview

A tutorial for deploying a private Hermes AI agent with Pulumi across Render, Modal, and Tailscale. Render hosts private services, Tailscale provides tailnet access, and Modal runs agent-generated code in temporary sandboxes.

## Source excerpt

Personal AI agents had their breakout this year. OpenClaw crossed 100,000 GitHub stars within months of launching, and self-hosting your own assistant went from a hobbyist trick to something a lot of developers actually do. I wrote up how to deploy that lobster to AWS or Hetzner back when it was everywhere. The one people are switching to now is Hermes, the open-source runtime from Nous Research, and it caught on just as quickly. The reason shows up in every "I ditched OpenClaw for Hermes" thread: it actually learns, building up memory and writing its own skills as it goes instead of running off a static, human-written list. Here is the part the launch videos skip. Hermes writes and runs its own code, with no human approving the commands. A model that can write code will eventually write a bad one, and the only thing between that command and your credentials is the sandbox it runs in. That is the box you do not want on the public internet. Researchers found 175,000 exposed Ollama servers sitting open in early 2026, and attackers hijack the ones they find for compute. The fix is not a better lock on the front door. It is to have no front door at all. So this post deploys a private Hermes agent as one Pulumi program across Render, Modal, and Tailscale. The agent and its chat UI run as Render private services with no public URL, Tailscale puts the UI on your tailnet, and Modal runs the agent's code in throwaway sandboxes. One pulumi up to stand it up, one pulumi destroy to tear it down, around $50 a month. No Makefile, no CLI escape hatches, and an honest look at the few places "nothing on the public internet" still leaks. What is Hermes? Hermes is the open-source, MIT-licensed agent runtime from Nous Research. It runs continuously on a server rather than living in a browser tab, and you talk to it through a chat UI or a messaging platform like Telegram, Discord, Slack, or Signal. A few things make it more than a chatbot: It is model-agnostic. You point it at any provi