狸 Arauto
Download
//hermes setup

Run it on your own server.

Arauto is just the app — the AI runs on your Hermes, with your keys and your data. You install one small companion next to it so the app can talk to it. Set it up once; it takes about two minutes.

~2 minutes
One command
No Docker · no accounts
器
01prerequisites

What you'll need

Three things. If your Hermes is already running, you're most of the way there.

A small Linux server

A cheap VPS is plenty (1 vCPU / 1 GB). Ubuntu or Debian, with root / sudo access.

Hermes installed & running

The companion sits next to your existing Hermes api_server on 127.0.0.1:8642.

About two minutes

One command does the rest — and re-running it later is always safe.

02install

Run one command

1

Install the companion

SSH into the box that runs Hermes and run this as root. Passing a domain installs the companion behind HTTPS (so the QR connect works) and prints your QR code, Server URL and API key.

root@your-server
$ curl -fsSL https://get.arautocompanion.app/install.sh | sudo DOMAIN=hermes.example.com bash
In your domain's DNS, add an A record pointing hermes.yourdomain.com to your server's IP.

Prefer to read it first? From a checkout of the companion folder, run sudo DOMAIN=hermes.example.com bash install.sh instead.

2

Grab the QR (or the URL + key)

When it finishes, the installer prints a QR code plus the Server URL and API key below it. You'll scan the QR in the app (fastest), or copy the two values by hand. Keep the key secret — it's the single shared token the app uses.

Re-running the installer is safe and keeps your existing key. Pass ROTATE_KEY=1 to mint a new one.
03https

Add HTTPS with a domain

The app sends the key as a Bearer token, so don't expose it over plain HTTP. That's why the install command above takes a DOMAIN — the installer sets up Caddy + a free Let's Encrypt certificate and serves the companion over https://… automatically.

Already run Caddy for other sites? The installer won't touch your Caddyfile — it prints the vhost block to add. Prefer nginx? Skip DOMAIN and reverse-proxy 127.0.0.1:8700 yourself. Either way, keep Hermes on loopback — only the companion is exposed.
04per-server guide

Set it up on your host

The install command is the same everywhere — the only difference is how you get a Linux box and point a domain at it. Pick yours.

VPS
Any Ubuntu / Debian VPSThe baseline — works on every provider.
  1. Create an Ubuntu 22.04+ server and SSH in as root.
  2. Point an A record (hermes.yourdomain.com) at the server's IP.
  3. Make sure your Hermes is installed and running on it.
  4. Run the HTTPS install command above with your domain. Done.
Open ports 80 and 443 in any firewall so Caddy can fetch the certificate.
DO
DigitalOcean DropletSimple dashboard, built-in DNS.
  1. Create a Droplet → Ubuntu, Basic / Regular, the $6 size is fine.
  2. Add an A record in Networking → Domains pointing at the Droplet.
  3. SSH in as root; confirm Hermes is running.
  4. Run the HTTPS install command with your domain.
DigitalOcean's firewall allows 80/443 by default — nothing extra to open.
HZ
Hetzner CloudBest price-to-power in the EU.
  1. Create a CX22 (or larger) server with Ubuntu 22.04.
  2. Point an A record at the server IP (your registrar or Hetzner DNS).
  3. SSH in as root; confirm Hermes is running.
  4. Run the HTTPS install command with your domain.
If you attached a Hetzner Firewall, allow inbound TCP 80 and 443.
AWS
AWS LightsailFixed-price instances on AWS.
  1. Create a Lightsail instance → Ubuntu; attach a static IP.
  2. In Networking, open ports 80 and 443 (HTTP/HTTPS).
  3. Point an A record at the static IP; SSH in and sudo -i.
  4. Confirm Hermes is running, then run the HTTPS install command.
Lightsail's default user is ubuntu — switch to root with sudo -i before running.
Pi
Raspberry Pi / home serverSelf-host at home — bring your own DNS.
  1. Run Ubuntu Server or Raspberry Pi OS (64-bit) with Hermes installed.
  2. Port-forward 80 and 443 from your router to the Pi.
  3. Use a dynamic-DNS domain (e.g. DuckDNS) pointing home.
  4. Run the HTTPS install command with that domain.
No public IP or CGNAT? Use a tunnel (e.g. Cloudflare Tunnel / Tailscale Funnel) to reach 127.0.0.1:8700 instead of port-forwarding.
05transparency

What this installs

Just one small piece sits next to your Hermes — a companion the app talks to. Here's everything it adds:

  • A small Arauto companion service (no extra packages) in /opt/arauto-companion
  • A systemd service so it keeps running and starts on boot
  • Caddy and a free, auto-renewing HTTPS certificate — only if you pass a domain
  • Nothing else — your Hermes, its config, and your data stay on your own server; the companion sends nothing to Arauto
Arauto appyour iPhoneyour device
Bearer ROUTER_KEY
companion:8700 · skills · config · provider · soulinstalled
Bearer HERMES_API_KEY
Hermes127.0.0.1:8642loopback

The companion proxies chat, sessions and models straight through to Hermes, and adds the few things Hermes' API can't do on its own: toggle skills, set the model + toolsets, choose your AI provider + key, and edit the persona.

06connect the app

Connect Arauto

The installer also prints a QR code. Open the app → Connect (onboarding) or Settings → Hermes connection, tap Scan QR code, and point your camera at it — both fields fill in and it connects on the spot.

Fastest
scan the qr
狸
  1. On the server, the installer shows a QR code in your terminal.
  2. In the app, tap Scan QR code on the Connect screen.
  3. Point the camera — it fills the URL + key and connects.
or paste manually
server url
❯https://hermes.example.com
and
api key
❯•••••••••••••••• (ROUTER_KEY)

Both values are printed alongside the QR. Stored on your device only — never on our servers.

However you connect, the app tests it and confirms “Connected — your server answered.” That's it — you're talking to your own Hermes.
07manage & configure

Manage & uninstall

It's a normal systemd service. Check status, follow logs, or remove it cleanly.

manage
# status & live logs
$ systemctl status arauto-companion
$ journalctl -u arauto-companion -f
uninstall
$ systemctl disable --now arauto-companion
$ rm -f /etc/systemd/system/arauto-companion.service
$ rm -rf /opt/arauto-companion
$ systemctl daemon-reload

This removes only the companion — your Hermes install and profile are untouched.

Configuration

All config lives in /opt/arauto-companion/companion.env (mode 0600). Edit it and systemctl restart arauto-companion, or re-run the installer with env overrides.

VariableDefaultMeaning
ROUTER_KEYgeneratedThe shared key the app sends. Secret.
PORT / HOST8700 / 0.0.0.0Where the companion listens. With a DOMAIN, HOST binds 127.0.0.1 (behind Caddy).
HERMES_BASE127.0.0.1:8642Your local Hermes api_server.
HERMES_API_KEYdetectedHermes' key, injected upstream for you.
HERMES_MODELunsetPin one chat model for every request.
HERMES_MODELSunsetCSV of models offered in the app's picker.
//all set

That's the whole setup.

Install the companion, paste the URL and key, and your assistant is live — private, on your server, entirely yours.

Get the app Back to overview