Setup My Hermes Dashboard

---
name: setup-my-hermes-dashboard
description: Give the user their own personal dashboard on their VPS, in the same look and stack as the Hermes dashboard (TanStack Start, Tailwind, SQLite), at dashboard.their-domain behind the same sign-in gate. It starts with no module but a built-in System monitoring group (latest conversations, Infra with server health, daily audit and one-click fixes, and a Models page to pick the AI model); the user asks Hermes for the modules they want and Hermes builds and ships them. Use after setup-vps.
argument-hint: "[domain, e.g. example.com] [alias, default hermes]"
user-invocable: true
---

Put a personal dashboard online at `https://dashboard.<domain>`, next to Hermes, behind the gate that `setup-vps` built. It starts with no module (a greeting, three status lights for the agent, a link to Hermes, a page of API keys, a Team page to see who can sign in and add or remove members) and, for admins, a "System monitoring" group at the bottom of the menu: Conversations (the latest chats with Hermes), Models (the AI model Hermes uses, switched in one click, and which providers are connected) and Infra (the server is checked every 15 minutes, Hermes writes a short audit every morning at 7, and each problem has a "Fix" button that hands the task to Hermes): the user then asks Hermes "add a module to my dashboard that shows..." and Hermes writes it, tests it, puts it online and pushes it to their GitHub. The first argument is the domain (ask if missing and they have several in `cf zones list`), the second the alias (default `hermes`; use it everywhere below). Do every step yourself, talk to the user in their language, short messages, no jargon (never say "token", "systemd", "repo" or "build" to them; say "access", "the service", "your GitHub" and "put online").

Never print a key or a token from the server. Run every remote command as `ssh hermes '<command>' < /dev/null`; when the login user is not `root`, prefix `install` with `sudo`. Never publish the dashboard any other way than `expose add`, and never replace an existing `~/projects/dashboard`: it holds the user's modules.

1. Check what is ready: `ssh -o BatchMode=yes hermes true` (otherwise run `connect-vps`), then `ssh hermes 'hermes-setup check'` lists hermes, gateway and dashboard as ok, `ssh hermes 'expose status'` lists `site=hermes.<domain>`, and `ssh hermes 'gh auth status'` is signed in (otherwise run `setup-vps` first).
2. Get the files on the server: `ssh hermes 'S=~/.cache/ai-maxxing-skills; if [ -d $S/.git ]; then git -C $S pull -q --ff-only; else mkdir -p ~/.cache && git clone -q --depth 1 https://github.com/Melvynx/ai-maxxing-skills $S; fi'`, then install both commands: `ssh hermes 'cd ~/.cache/ai-maxxing-skills/skills/setup-my-hermes-dashboard/scripts && install -m 755 dashboard.sh /usr/local/bin/dashboard && install -m 755 dashboard-cli /usr/local/bin/dashboard-cli'`. `dashboard` without arguments prints its commands.
3. Create the code, only if `ssh hermes 'test -d ~/projects/dashboard'` fails: `ssh hermes 'mkdir -p ~/projects && cp -R ~/.cache/ai-maxxing-skills/skills/setup-my-hermes-dashboard/template ~/projects/dashboard && cd ~/projects/dashboard && git init -q -b main && git add -A && git commit -qm "Dashboard: empty shell"'`. Save it on their GitHub, private: `ssh hermes 'cd ~/projects/dashboard && gh repo create hermes-dashboard --private --source . --push'`. If that name is taken on their account, ask before using another one.
4. Install Node with `ssh hermes 'dashboard install-node'` (Node 24 and pnpm, skipped when there).
5. Put it in service: their first name (ask, or the first word of `git config --global user.name`), then `ssh hermes 'DASHBOARD_OWNER=<first name> DASHBOARD_URL=https://dashboard.<domain> HERMES_URL=https://hermes.<domain> dashboard deploy'`, in the background (a few minutes the first time). It ends with `dashboard ok on 127.0.0.1:8794, hermes ok`. Exit code 4 prints why the checks failed, 5 prints the service log.
6. Give Hermes its access to the dashboard: `ssh hermes 'dashboard key'`, then `ssh hermes 'dashboard-cli get /api/v1/whoami'` answers `"key": "hermes"`.
7. Teach Hermes: `ssh hermes 'hermes-setup add dashboard'` puts the `dashboard` skill in `~/.agents/skills`, the folder of every skill on the server (Hermes reads it, Claude Code through `~/.claude/skills`). `ssh hermes 'hermes skills list'` then lists `dashboard`. Hermes then knows where the code is, how to add a module ([template/AGENTS.md](template/AGENTS.md)), and to run `dashboard deploy`, commit and push. The user can also skip this whole skill and ask Hermes "create my dashboard": its `create-dashboard` skill does the same steps from the server.
8. Put it online: `ssh hermes 'expose add dashboard.<domain> 8794'`. Exit code 4 means `dashboard.<domain>` already points somewhere else: ask before picking another name such as `home.<domain>`, then rerun step 5 with that `DASHBOARD_URL`. Then `ssh hermes 'expose status'` must list `site=dashboard.<domain>` and no line starting with `UNPROTECTED`.
9. Prove it from the Mac, after a minute for the address to spread: `curl -s -o /dev/null -w '%{http_code} %{redirect_url}' https://dashboard.<domain>` answers `302` to `/.gate/login` (or `200` from an IP they saved). Then ask the user to open `https://dashboard.<domain>`: the same sign-in as Hermes (their email, then the code it receives, when `ssh hermes 'expose status'` says `sign_in=code`), then their name, the three status lights, the Infra card, "System monitoring" at the bottom of the menu, "No module yet" and their email at the bottom of the menu mean done. A minute later the Infra page shows its first check; red or orange lines there are real findings about the server to tell the user about, not a failed install.
10. Their first module: ask them to send Hermes, on Telegram or Discord, one of the asks the page shows, for example "Add a module to my dashboard with my crons and when they run next." It takes Hermes a few minutes; the new page appears in the sidebar and on the home. If Hermes says it does not know the dashboard, restart its chat with `ssh hermes 'hermes gateway restart'` and ask again.
11. Tell every agent, in the `## VPS` block (brain `AGENTS.md`, `~/.claude/rules/vps.md`, `~/.codex/AGENTS.md` if Codex is installed), keeping every existing line: the personal dashboard is `https://dashboard.<domain>`, its code is `~/projects/dashboard` on the server (GitHub `hermes-dashboard`), Hermes adds modules to it on request, and `ssh hermes 'dashboard deploy'` puts a change online.

End with a short check list, a check or a cross on each line: commands installed, code on their GitHub (private), Node ready, service running (Hermes reachable), Hermes has its access, Hermes knows the dashboard, online at `https://dashboard.<domain>`, no unprotected page, Infra checked and the daily audit on, agents told. Then tell the user in 3 lines: the dashboard is theirs, its Infra page watches the server and suggests fixes, ask Hermes for any module they want ("my crons", "a morning report", "today's sales"), every change is saved on their GitHub, so nothing is ever lost, and they can let someone in from the Team page (account menu, bottom left) or with `ssh hermes 'expose user add <email> member --invite'`: a member sees the modules but not Hermes, the API keys or the Team page.