Full disclosure up front: I maintain a Railway template for this and get a kickback if you deploy through it. That's the whole pitch — everything below is the actual writeup.
I've been poking at the self-improving-agent space (OpenClaw and friends) and wanted to try Nous Research's Hermes Agent without handing it API keys to a hosted box. It's genuinely interesting — it accumulates skills over sessions instead of starting cold every time — but self-hosting it on a PaaS like Railway surfaces two gotchas that aren't obvious from the upstream docs, and one design decision that's easy to trip over if you're used to disabling auth "for now."
1. The dashboard fails closed, not open
Since Nous Research's June 2026 hardening pass, the Hermes dashboard refuses to bind to a non-loopback address without a registered auth provider. If you leave the password variable empty expecting an open dashboard for local testing, you don't get one — you get no dashboard at all, and HERMES_DASHBOARD_INSECURE is accepted and silently ignored. It fails safe, which I'd rather have than the alternative, but it means "just don't set a password" isn't a valid quick-start path anymore. The fix I ended up with: generate a password on first boot if none is supplied, persist it to the volume so it survives redeploys, and print it to the deploy logs.
