A step-by-step guide to deploying a self-hosted Hermes AI agent (from Nous Research) as a single Pulumi program across Render, Modal, and Tailscale. The architecture keeps both the agent gateway and its chat UI (Open WebUI) as private Render services with no public URLs. Tailscale exposes the UI exclusively to devices on your tailnet via `tailscale serve`, while Modal runs the agent's code in ephemeral sandboxes. Secrets are managed through Pulumi ESC, the Render SDK is bridged from its official Terraform provider, and Docker images are built and pushed during `pulumi up`. The post covers the full TypeScript, Python, and YAML program, cost breakdown (~$50/month), security trade-offs, and extension patterns like cron scheduling and Telegram integration.
