22:26David Ondrej · Tutorial
This MCP makes Hermes Agent 10x more powerful
A 22-minute live walkthrough of wiring Hermes Agent to Apify MCP connectors and Supabase to automate lead scraping, scoring, and outreach.
June 15thThe argument in one line.
Tailscale gives every AI agent — on a laptop or a VPS — a private, zero-open-port network where any agent can reach any other by name, and an AI CLI agent like Codex can run the entire install and lockdown for you.
Read if. Skip if.
READ IF YOU ARE…
- You're running more than one AI coding agent (Codex, Claude Code, Hermes) across a laptop and one or more VPSs and want them to reach each other without manual SSH each time.
- You have open ports on a VPS and no firewall rules, and want a concrete walkthrough of locking a server down to zero public exposure.
- You're comfortable delegating terminal work to an AI agent and want to see a real session of an agent installing and configuring infrastructure end to end.
- You manage API keys across multiple agents or VPSs and want one place to store and route them instead of copying secrets machine to machine.
SKIP IF…
- You don't run any self-hosted agents or VPSs — this is infrastructure for people already operating their own servers, not a consumer privacy-VPN pitch.
- You want a deep technical explainer of WireGuard or networking internals — the video treats Tailscale as a tool you configure, not something it explains under the hood.
The full version, fast.
Tailscale is a free private network that connects every device — laptops, VPSs, phones — into one tailnet where any machine can reach another by name over an encrypted tunnel, with zero ports exposed to the public internet. That matters because most builders now run several AI agents across multiple machines, and Tailscale lets one agent reach and manage another without SSH keys. The video adds a laptop and a Hostinger VPS to a tailnet, uses the Codex CLI agent to install Tailscale and lock the VPS down (firewall closed, SSH passwords disabled) from plain-English instructions, then installs Hermes Agent and routes its model calls through Aperture, Tailscale's AI gateway, so the API key never touches the VPS. The payoff: one prompt to a personal agent can update or fix every agent on the network.
Free for members
Chat with this breakdown — free.
Sign in and you get 23 free chat messages on us — ask for the hook, quote a framework, find the exact transcript moment, generate a markdown action plan. Bring your own key when you want unlimited.
Create a free account →Where the time goes.
00:00 – 00:36
01 · Cold open: Tailscale for AI agents
Hook line and framing: Tailscale connects all your machines, letting one agent control any number of others, local or on a VPS.
00:36 – 02:43
02 · Why agents made Tailscale essential
Managing multiple agents across machines one by one is a nightmare; Tailscale gives zero open ports, a single console per machine, and identity-based revocation instead of SSH keys.
02:43 – 03:53
03 · Free tier, WireGuard speed, and ACLs
Free tier covers unlimited devices and 6 users; traffic runs peer-to-peer over WireGuard; Access Control Lists scope which devices can reach which.
03:53 – 06:30
04 · Signing up and provisioning a VPS
Tailscale signup, adding a second device, and a full Hostinger VPS purchase flow (sponsor segment) choosing a KVM 2 plan and Ubuntu.
06:30 – 08:29
05 · VPS finishes setup — handing the CLI to an agent
VPS provisioning completes; David argues for describing the high-level goal to an AI agent instead of doing setup manually, and opens Codex to do it.
08:29 – 10:53
06 · Codex installs and authenticates Tailscale on the VPS
David SSHes into the VPS manually once, then tells Codex the goal; Codex runs the install and auth commands, including the tailscale up login link.
10:53 – 13:53
07 · VPS joins the tailnet — SSH gives way to Tailscale
Both machines confirm on the same tailnet; the SSH session used to bootstrap the VPS is closed and reopened over Tailscale instead.
13:53 – 15:17
08 · Locking down the VPS
One instruction to Codex results in all public inbound ports blocked, SSH password auth disabled, and only Tailscale traffic allowed, keeping the operator's own SSH key as the exception.
15:17 – 19:17
09 · Aperture: a private AI gateway
Introduces Aperture, Tailscale's AI gateway, for storing API keys once and routing every agent's model calls through it instead of distributing keys per machine.
19:17 – 22:34
10 · Installing Hermes Agent and wiring it to Aperture
Codex installs Hermes Agent on the VPS, is told to stop at the OpenRouter API key prompt, and the key is instead configured through Aperture as a provider.
22:34 – 25:14
11 · End-to-end test over Tailscale
Hermes Agent installation completes, is wired to Aperture, and a live chat test confirms the model call routes through Aperture over Tailscale with no key stored on the VPS.
25:14 – 27:37
12 · Live model swap with one prompt
David asks Hermes Agent (via Codex/Tailscale) to switch its default model from GLM 5.2 to GPT-5.6 — done and verified with a single instruction.
27:37 – 28:29
13 · Wrap-up
Recap of what was accomplished — VPS locked down, Hermes installed, API keys centralized — and a closing push to actually implement the steps.
Lines worth screenshotting.
- Tailscale's free tier includes unlimited devices and up to six users, so a solo builder or small team pays nothing for the networking layer — only the VPS itself costs money.
- Putting a VPS on a private network lets it run with zero open inbound ports, which removes the single biggest attack surface bots scan for on the public internet.
- Tailscale ties device access to a real identity (Google or GitHub), not an SSH key, so revoking a stolen laptop or an ex-employee's access instantly cuts it off the whole network.
- Access Control Lists let you restrict which devices or people can reach which machines, so one compromised agent can only damage what it's explicitly allowed to touch.
- Aperture, Tailscale's AI gateway, stores API keys once and routes every agent's model calls through it, so a provider key never has to be copied onto an individual VPS.
- An AI CLI agent can SSH into a fresh VPS, install Tailscale, authenticate it, and lock down the firewall from a single plain-English instruction — no manual command typing required.
- Once every machine shares a tailnet, updating the default model across five agents on five different VPSs takes one prompt to a personal agent instead of five manual SSH sessions.
- Tailscale runs on WireGuard and routes traffic directly peer-to-peer between machines rather than through a middleman server, which keeps agent-to-agent API calls fast.
- A locked-down VPS reachable only through Tailscale is out of reach for the constant bot scanning that targets any server with an open SSH port.
- The presenter argues most AI-generated 'slop' comes from operators who don't know what to build, not from model capability — the bottleneck is taste and domain expertise, not the tool.
Tailscale plus an AI agent turns VPS setup into one sentence.
WHAT TO LEARN
A private, zero-open-port network combined with an AI CLI agent collapses VPS provisioning, security lockdown, and multi-agent orchestration into plain-English instructions instead of manual SSH sessions.
01Cold open: Tailscale for AI agents
- Tailscale is framed here specifically as agent infrastructure, not a general privacy VPN — its job is letting one agent command any other machine on the network.
02Why agents made Tailscale essential
- Managing several AI agents across separate VPSs one by one (model swaps, crash fixes) is described as the real bottleneck once you're running more than one or two agents.
- Putting every machine on Tailscale removes the need for exposed ports entirely, cutting off the constant bot scanning that targets open SSH/HTTP ports.
- Device access is tied to a real identity (Google/GitHub) instead of an SSH key, so revoking a stolen device or an ex-employee is a single click that instantly cuts network access.
03Free tier, WireGuard speed, and ACLs
- The free tier covers unlimited devices and up to six users, so the only real cost in this setup is the VPS itself.
- Traffic runs peer-to-peer over WireGuard rather than through a middleman server, which keeps high-frequency agent API calls fast.
- Access Control Lists let you scope which devices or people can reach which machines, so a single compromised agent is contained instead of exposing the whole tailnet.
04Signing up and provisioning a VPS
- A KVM 2 plan is presented as enough headroom to run roughly 20 agents at once, a sizing heuristic worth remembering when picking a VPS tier for agent work.
- Locking in a longer VPS commitment period is pitched as a hedge against rising hosting prices, not just a discount play.
05VPS finishes setup — handing the CLI to an agent
- Describing the high-level goal and letting the model figure out the exact commands is faster than typing and reading terminal output yourself, per the video's core argument for delegating setup to an agent.
- The video argues most software usage is shifting toward agents operating it on a human's behalf, with humans setting intent and monitoring outcomes.
06Codex installs and authenticates Tailscale on the VPS
- A single plain-English instruction ('install Tailscale on the VPS, put it on the same network as my MacBook') was enough for the agent to run the actual install and auth commands unattended.
- Correcting an agent's typos mid-session is called out as counterproductive — language models parse intent past minor typos, so fixing them wastes a turn.
07VPS joins the tailnet — SSH gives way to Tailscale
- Once both machines share a tailnet, the SSH session used to bootstrap the VPS can be closed and replaced with a Tailscale-only connection for all future access.
08Locking down the VPS
- A single lockdown instruction produced: all public inbound ports blocked, SSH password auth disabled, only Tailscale traffic allowed, with the operator's own SSH key kept as the one exception.
- The video's framing is that most VPS operators skip exactly this lockdown step, so a firewall this tight is presented as a meaningful security edge on its own.
09Aperture: a private AI gateway
- Aperture stores provider API keys (OpenAI/Anthropic/custom) in one place on the tailnet, so individual VPSs never hold a raw key — they call Aperture instead.
- Aperture joins the tailnet as its own node, meaning access to it is governed by the same ACLs as every other machine rather than a separate auth system.
10Installing Hermes Agent and wiring it to Aperture
- Hermes Agent's setup wizard was pointed at Aperture as its inference provider instead of pasting an OpenRouter key directly onto the VPS.
- The agent was told to stop at the API-key prompt so the human could hand that one credential over manually — the one step deliberately kept out of the agent's hands.
11End-to-end test over Tailscale
- A successful chat with Hermes confirmed the full chain worked: VPS to Aperture to OpenRouter to model, all routed privately over the tailnet with no key stored on the VPS.
12Live model swap with one prompt
- Switching Hermes's default model (GLM 5.2 to GPT-5.6) took one plain-English instruction to the agent already connected to the VPS — no manual SSH, no config file editing by hand.
- This is presented as the actual payoff of the whole setup: once the network and gateway exist, keeping every agent on the latest model is a single prompt, not a per-machine chore.
13Wrap-up
- The closing claim is that most operators still run VPSs with open ports, no firewall, and API keys scattered across machines — completing just these steps is presented as ahead of the norm.
Terms worth knowing.
- Tailnet
- The private network Tailscale creates for a user or team — every device added to it can see and reach every other device by name over an encrypted tunnel.
- WireGuard
- A modern, fast VPN protocol that Tailscale is built on; it creates direct encrypted tunnels between devices instead of routing traffic through a central server.
- Access Control List (ACL)
- A rule set that restricts which devices or users on a tailnet can reach which other devices, so access can be scoped down instead of defaulting to full network-wide trust.
- Aperture
- Tailscale's AI gateway product — it stores API keys for providers like OpenAI or Anthropic in one place and lets agents on the tailnet call models without the key ever being copied onto an individual machine.
- Hermes Agent
- A self-hostable AI agent product from Nous Research that can be installed on a VPS to run autonomous or chat-based tasks, connectable to Discord or Telegram.
- Zero open ports
- A server configuration where no inbound ports are exposed to the public internet — all access happens through a private tunnel like Tailscale instead of direct SSH or HTTP.
- KVM VPS plan
- A virtual private server tier using kernel-based virtual machine virtualization, giving the server dedicated (not shared) CPU and memory resources rather than a shared pool.
Things they pointed at.
08:29toolCodex CLI
19:17toolHermes Agent (Nous Research)
Lines you could clip.
10:14
“99.9% of software will be used by agents. That includes tools. That includes APIs. That includes SaaS.”
13:50
“A single prompt like this could be the difference between your VPS being exposed and being secure.”
20:59
“If you're using Haiku 4.5, please, you need to renounce your sense.”
27:34
“This already, just the contents in this one video, will already put you ahead of 99% of people in AI.”
Word for word.
Read-along
Don't just watch it. Burn it in.
See every word as it's spoken — crank it to 2× and still catch all of it. The same dual-channel trick behind Amazon's Kindle + Audible.
metaphor
00:00My name is David Andre, and here's how to use Tailscale with AI agents. So first, what even is Tailscale? Tailscale is a private network that connects all your machines together.
00:09And this matters a lot in the AI era because it allows a single agent to control any number of other agents no matter if they're local on your computer or on a VPS. And these are just few of the reasons why is growing exponentially.
00:22This is the five year graph on Google Trends, and you can see the popularity is exploding. Right? More and more people are using Tailscale on their devices.
00:30So in this video, I'll explain what Telescale is, how it works, and why it's revolutionary with multi agent setups. Now what you need to understand is that agents made Telescale OP.
00:41Everyone is running more AI agents than ever before. It doesn't matter if it's Codex, ClotCode, Hermes, Py, Cursor, or something else. Both me and you are running more agents now than a year or two ago.
00:51But managing them one by one is a nightmare. Every small update crash needs manual fixing. You have Hermes on one VPS, It crashes.
00:58You have OpenClaw on another VPS. It needs a model change. Takes so much time managing this manually.
01:03But if you put them on a Telescal network, any one of your agents, maybe a Pi agent in your MacBook, can command and fix any other agent quickly and without your manual involvement. Also, if you use Tailscale, your machines can have zero open ports.
01:17Every open port is a point of exposure. It's a weakness since there are countless bots scanning the whole Internet nonstop. But Tailscale connects your machines through a private encrypted tunnel, so you don't need to have any exposed ports to the Internet.
01:31And this instantly makes all of your VPSs a lot more protected from bioreactors. Now multi agent orchestration is what took Tailscale to another level. It was already a great technology, but nowadays, where all of us are running multiple agents, Telescale is going from a useful technology to a must have, especially if you have a team or you're running agents for other people, say friends or family.
01:52And that's because with Telescale, every machine you add shows up in a single Telescale console with a clean name that you quickly recognize. Also, you can connect to any of them just by name from anywhere in the world. Another thing that makes Telescale more secure is that your access is tied to your real identity, like Google or GitHub account.
02:11So there are no SSH keys needed. So if your laptop ever gets stolen or one of your employees in your company leaves, you just revoke that specific device, and it instantly loses access to the whole Telescale network. And what's nice is that Telescal is free for most of us.
02:24The free tier includes unlimited devices and up to six different users, which is way more than most of us will ever need.
02:30You only pay for the VPS itself. For example, you can get one from Hostinger for super cheap. So the entire networking layer costs you nothing when you're building solo or with a small team.
02:40Another reason why so many people love Telescale is that it's fast and direct. All the traffic goes directly between your machines, peer to peer, not through a middleman server.
02:50Telescale is built on WireGuard, and that's the fastest VPN protocol out there. And that means that your agents can make tons of API calls and all of them stay fast. Real quick, if you're watching this video, please check if you're subscribed.
03:02According to YouTube Studio, the vast majority of you are not subscribed. So please go below the video and click the subscribe button. It's completely free, and it helps out a lot.
03:09Now in a second, I'm about to show you how to set up Tailskill on your own machine and how we can connect the different agents to it. But the last concept you need to understand before we jump to the building is access control lists. By default, every device on your telnet can talk to every other device.
03:23But with ACLs, you can write simple rules like this agent can only reach this one VPS, or this person on my team can only access these agents, stuff like that. So even if one computer or agent or person gets compromised, it can only do damage to the machines it's allowed, not to every single thing on the Telescale network.
03:42So now let me show you how to set up Telescale, and, actually, it's very easy. You don't have to be a developer at all. And then I'm gonna show you how to use it with a multi agent setup.
03:50So the first step is go to telescale.com and go to top right and click on get started. And, again, you can get started completely for free.
03:58The free plan is very, very generous. I'm just gonna go with GitHub. And immediately once you log in, you see the steps on how to add a second device.
04:05Right? So your device, MacBook, was added to your network. So here, we will add the second device.
04:10But before we do that, open up any terminal, so either the built in terminal on Mac OS or Windows, doesn't matter. I would recommend using CMUX. This is the terminal I use.
04:18Again, CMUX is completely free. I'm gonna type in Telescale up to make sure it's running.
04:25Telescale status. Okay. And back in the browser, I'm gonna click on Linux, and it's gonna give us the install command for Linux.
04:31So then we need a second machine to connect it to. And, again, that could be your friend, your parents, your other VPS.
04:38In this case, since we care about running a multi agent setup, I'm gonna go with a VPS, and most, if not all, VPSs are Linux. Now, again, you can use Telescale with any AI agent, any device, whether it's Linux, Windows, MacOS, whether it's a VPS, or whether it's 10 different VPSs.
04:54In fact, I run multiple different Hermes agents on hosting the VPSs, but a Hostinger is what I use for all of my VPSs, and it's also what everyone else on my team uses. So if you don't have a VPS setup yet, I highly recommend getting one from Hostinger. It's very affordable.
05:08Also, makes the setup super easy. I'm gonna leave a link to the landing page below the video. Here, you can select either when you wanna manage Hermes agent or Hermes on a VPS.
05:17I'm gonna select that with the k v m two plan. This is more than enough to run 20 different AI agents, whether that's agent zero, open code, open claw, codex, clawed code Hermes.
05:28Doesn't matter. Just go with the k v m two plan, then select the period. I recommend going for twenty four months because hardware prices are becoming more and more expensive.
05:36So I wouldn't be surprised if in the future, maybe a year from now, renting a VPS is a lot more expensive than now. So that's why I would lock in the longest period possible. Plus, if you go with twenty four months, you get the highest discount.
05:48But if you want to save even more money, go to the right, click on have a coupon code, and type in code david for additional 10% off. Here, it's asking if we wanna have a prepaid API key. I we don't need that.
06:00We don't need the scraping, origintic mail, VPS backups. You can skip that server. Just choose whatever is closest to you.
06:07I'm in Poland, Katowice, so Lithuania is good. And the operating system, either use Hermes agent or just go with plain OS Ubuntu because we're gonna be setting up Telescale.
06:15This might be the easier option. And then scroll back up and click continue. Now log in with your Hostinger account.
06:20If you don't have one, just create it. It's super easy. It takes, like, twenty seconds.
06:23And then finish the checkout by adding your card and your billing details. Now once you complete the purchase, we might need to do some further configuration. So just, again, select the Ubuntu as the operating system, then generate a root password.
06:36This is very important, so make sure to save it somewhere. But don't worry if you forget it. Hostinger has an easy way to reset that.
06:42Then click on next. You can skip these two and click on finish setup. Now it's gonna take usually one or two minutes to set up your VPS.
06:49And, again, if you don't have a VPS, I highly recommend you get one from Hostinger. I've been using their VPSs for nearly three years now. It's what everyone on my team uses as well.
06:57And to get started, use the first link below the video with the code David to save additional 10% off. Thank you to Hostinger for sponsoring this video. So, again, inside of Telescale, you have many different options.
07:07Right? We're gonna go with Linux here, which gives us a curl command, which is the install script to install Telescale on the VPS. And by the way, everything from this video, all of the scripts, terminal commands, skills, prompts, everything is gonna be in a single package in the second link below the video.
07:23So it's completely free. Feel free to get it. We're gonna put all of that into a single bundle.
07:28Again, second link blog video. Feel free to grab it. Alright.
07:30So the VPS has finished setting up. Click on the left manage VPS to get to the dashboard, and here we can see all the stats. Obviously, it's starting yet, so we don't see any of the graphs.
07:39But what matters is the root access, which is the and the root password. Now we could do all of this manually. You know, we could open up a new terminal, SSH manually, do all of that.
07:48But I actually wanna show you the power of AI agents. In fact, you can open any terminal, launch up Cloud Code or, you know, Codex, and you can have them do this full setup for you. A lot of you are still underutilizing AI agents.
08:00You're not realizing what they can do. You're still stuck in 2025 or 2024 with the previous realm where you have to describe every task and come with the idea.
08:08No. You just need to give it the big intent. Models like GPT 5.6 or Fable five are they're like, they're almost AGI.
08:15These models are super intelligent. Just describe what you're doing. The most abstract high level goal and the models will walk you through the steps.
08:23So in this case, since the latest model is Codex, we're gonna use Codex. Okay? If you wanna be, like, super fast, you'll just give the credentials to Codex.
08:32It's not the best practice, so I'm gonna connect to the VPS myself, and then I'm gonna tell Codex to operate it. Right? So I'm gonna say, do you see this CMUX workspace just so it kinda starts up?
08:44I'm using 5.6 Sol medium. Do not use anything hard in medium, by the way. It's gonna absolutely destroy your Codex limits.
08:50It's not necessary. Yeah. Just stick on medium.
08:53So I'm gonna SSH here. Are you sure you wanna continue? Yes.
08:56And then I'm gonna paste in the passwords from earlier. And by the way, if you forgot that root password, just click on change right here inside of Hostinger panel. Super easy.
09:05Boom. Paste that in. And just like that, we are SSHed, which again, if you don't know what SSH means, don't worry about it at all.
09:13You don't have to understand all these details, all these protocols. Just follow along what I'm doing. The only thing you need to understand is that SSH is a way for your MacBook to connect to the VPS, but we're gonna use Telescal now.
09:26So I'm gonna say, do you see the other CMUX pane where I just SSH ed into my VPS? In the meantime, I'm gonna switch to Brave Browser, copy this command command, boom, right here. Go back to CMUX.
09:41And okay. So the codecs can now see it. So I say, run this on there.
09:46The goal is to install Tailscale on the VPS. So just tell it the goal. In fact, I probably wouldn't even need to give it that command.
09:55Right? Like, it could probably just find it or figure it out by itself. Codex is very smart, especially with 5.6 sol.
10:03And, this setup, I could do it myself. You know? I could run these terminals myself, but then I have to read the outputs of the terminal commands.
10:09I have to understand it, all of that. It's slow. The future belongs to AI agents.
10:1399.9% of software will be used by agents.
10:17That includes tools. That includes APIs. That includes SaaS.
10:21It's gonna be used by agents. We humans, we're just gonna manage them. You're gonna tell the intent.
10:26You know, you're gonna set the goal, set the intention of the company, of the team of agents, and then you're be monitoring them if something goes wrong. But you really need to think and start working in this era of the future.
10:38Stop trying to do everything yourself and micromanage these agents on how to implement things. You need to just give it the high level goal and let it do what it does. So Codex is already saying the next step is to run TailsClub to authenticate.
10:49So he can say do it and help me put it on the same TailsScale network as my MacBook is.
11:00Feel free to run terminal commands. Boom. You can see that Codex ran the command TailsClub on the VPS, and now it gives us the login.
11:09It's probably gonna give it back to me. And you can see I have these commands where it, like, knows how to use CMUX. It knows to do a timeout and wait for the other pane to confirm.
11:18This is because of my skills. Okay? I have a specific skill for CMUX and a specific skill for managing VPS servers so my agents know all of this, and they can operate much more smoothly and much more quickly than other people's agents.
11:31So if you wanna have access to all of my skills, just go to davidentre.com/skills. Again, we're gonna leave a link to this below the video, and just grab it. It's completely free.
11:39Let's switch back to c mux, and let's see. Okay. Open this link.
11:41So I'm gonna copy this link. Codex gave me. Boom.
11:44New tab. Paste that in. Uh, authenticate the device.
11:47So just whatever you used at the beginning. If you used GitHub, use GitHub. If you used Google, use Google.
11:51Okay. There we are. Connect device.
11:52So let's click connect, and login successful. So I'm gonna take a screenshot. Boom.
11:57Go back to Cmax, paste it to correct. What now? Be concise.
12:02And by the way, if you ever make typo, do not correct it. Okay? That's a rookie mistake.
12:06When somebody's correcting typos in AI agents, you you know they know nothing about LLMs and NEXT token predictions. These are literally language models. They can understand you perfectly.
12:16So login succeeded. I'll verify the VPS MAC and see each other. Done VPS is still nice.
12:20Okay. Great. So now let me show you the power of Telescal because now we have the same Telescal network on my MacBook and on the VPS, which means we can seamlessly connect between one another.
12:33In fact, let me just ask Codex. Can we now close the SSH and interact with the VPS through Telescale? Answer in short.
12:41Yes. You can close this SSH session then reconnect securely through Telescale. Okay?
12:45I'll say do it in the other Cmax pane. Okay. So it asked for the password again, so I put it.
12:50But now let me ask Codex, are we now connected to the VPS via Telescale? Yes or no?
12:56In fact, it said in the previous message, so I didn't need to ask it. But yeah.
13:00Great. So the first thing you should do before you install Hermes agent or anything else is tell, you know, Codex or Clothcode, whichever agent is helping you set this up, to log down the v VPS.
13:11Right? So I'm gonna say, now that we have Telescale installed, I want you to log down the VPS.
13:17Disable all ports and make it as secure as possible so that it is only accessible through tail scale. And this already will put you ahead of 99% of people in the AI space.
13:27Most people don't have firewall enabled on their VPS. They have many open ports. They have no clue what they're doing.
13:33And all it takes is using a powerful agent to do this for you. Right? Literally, a single prompt like this could be the difference between your VPS being exposed and being secure.
13:42Now, obviously, you do need to do the Telescal setup, but in this video, I'm showing you all the steps. As you can see, you you don't have to be a developer. I'm talking to this Codex agent in plain English.
13:51Sometimes I'm asking the dumbest questions, and it's able to do what I wanted to do because these agents are so powerful. . GPT 5.6 Soul is a very powerful model.
14:02Telescale is a powerful technology. If you use the right tools, you don't have to be a 10x developer. You can still achieve the same results.
14:09So it's asking me, your Mac has this SSH key. We can yes. It wants to confirm this, so I'm just gonna say yes, and it's gonna do whatever it needs to do.
14:18So now Codex is doing all the things it needs to do to make our VPS secure. I'm just gonna let it run here. And there it is.
14:25VPS locked down successfully. All public inbound ports blocked. Only Telescale traffic allowed.
14:30Public SSH blocked. SSH password disabled. MAC SSH key access verified.
14:34Telescale Direct Connection verified. Nice. So VPS is fully secure now.
14:38In the next step, I'm gonna show you some of the use cases of how I use it, especially when an AI agent crashes or when AI agent needs updating. It's a hassle, and that's why a lot of people go away from OpenClaw or Hermes is because the setup can be lengthy. But even after you set it up, you know, the agents, they crash.
14:55The gateway closes. There's issues, and then fixing them takes a lot of time.
14:59You know, you need to SSH again. You need to remember the IP address. You need to remember the root password.
15:05With Telescale, all of these problems are solved. Okay. So next, I'm gonna have Codex install Hermes agent on the VPS.
15:12I'm gonna type clear and say, now install Hermes agent on the VPS. Use deep API skill to find out all the install steps.
15:22And, again, instead of me having to do this setup myself, we're gonna use codecs to do that. Also, while it's running, another great thing to use with Telescale is Aperture.
15:32This allows us to save API keys securely between the different devices on our telnet. So instead of having one API key in Hermes, another one on your MacBook, another one in OpenClaw, Telescal invented aperture, which is a better way to manage all of these secrets and environment variables across different devices.
15:52Alright. Checking in on Codex here. See what's happening.
15:55Found okay. Deep API found official new system installer. Okay.
15:59So I'm refreshing it. Okay. Good.
16:02We're gonna leave it running. And, again, it just runs autonomously. In the meantime, we can set up Aperture.
16:07So here, click on get started. Select the same email address. Boom.
16:11Get started now. Next, select some host name. I'm just gonna try David's, but it's be taken.
16:17Oh, it's not taken. Amazing. So now we can just probably have our codec set it up.
16:23K. What are you doing? Get to work, stop wasting time, and just use this command to install her mess agent on the VPS.
16:31I don't know what was Codex running. Personally, I think GBT 5.6 Sol is worse than Fable. I know a lot of people disagree, but I think Fable is significantly better than GBT 5.6.
16:41Anyways, here in Aperture, I'm just gonna click the button, authorize to Telescale. It's gonna be faster. We don't have to have CoreX help with us.
16:48Select the same account again, and then click connect device. Aperture will join your Telnet as a new node.
16:55So actually here inside of Telescal, we can probably see it, machines, and there it is. So one of these, probably this one, yeah, this one is actually Aperture, so we can probably rename it aperture.
17:09And this will handle all of our environment variables, secrets, API keys, so we can safely and securely distribute them across multiple different agents on different VPSs. But what's more, we can do so quickly.
17:22Like, let's be honest. Nobody wants to manage 10 different API keys across seven different agents.
17:27Just easier to have it in a single centralized location. Alright. Checking in on the progress of Codex here.
17:33It's doing stuff, and we can see on the right pane, it's installing the dependencies for Hermes agent. And, again, I don't have to manage it.
17:39You know? I just have a powerful agent like Codex or Clothecode, and I trust it that it will do what I tasked it to do.
17:46So, again, the leverage on using AI agents if you have the right setup, is really immense. You can literally use one AI agent to help you set up another one. Right?
17:53So on this VPS, I would have to do this myself. I would have to manage all these steps myself, but since I have codecs already installed on my MacBook and since I have CMUX installed on my MacBook and since I gave Codex a skill on how to manage and use CMUX, all of this is just .
18:11It's super easy. And again, I literally open sourced all of my skills for free. It's gonna be linked below the video.
18:16Just grab them. You can see there's a folder on agent orchestration, ops and setup, research and web, thinking docs, and skill offering. So all of my skills, including the ones used here, like the CMAC skill and the VPS management skill are completely open sourced now.
18:31Feel free to use them. Hermes installed is it asks, uh, just go through the steps. Stop when it asks for OpenRouter API key.
18:42Okay. That's the only step I'm gonna give it myself. Alright.
18:45So so back to CMUX here. As you can see, Codex went through all the steps. You click through it, and now it's asking for the open router API key.
18:52So I'm gonna say instead of giving it directly, I want to use aperture.
18:58Let's make sure the okay. That's good.
19:02Telescale to ensure to store all of the API keys, and then we give them to the different AI agents on the different VPS servers from there.
19:14How do we do it? Guide me through it. Be very concise.
19:17So since this is during the setup, I'm not sure how we can insert it there. So, again, here is using another one of my skills, setup help. And then using Deep API, I did a quick web search.
19:27I already have a aperture setup. I already added it to our TL scale network. What's next?
19:32K. So the voice transcription fucked up here. So here I am in aperture, but since, honestly, I'm pretty new to this, I'll just gonna take a screenshot and get codex to guide me.
19:43So paste that in and say, guide me through the UI. Another open use case of using AI agents, sending a screenshot and helping you do the setup that the agent cannot do. Okay.
19:53Go to providers in the API key section. Alright. Here.
19:56Go to providers. Okay. Boom.
19:59Add a provider. Open router. K.
20:02And let's say, like, you know, anytime you want more inputs, just do another screen. Just say, what now? And, again, it's following my setup help skill.
20:09That's why it's formatting the responses in this way. Current step, pacer open our API key into the API key field. Just gonna create a new one here.
20:17Tail scale testing. Put some limit. $10 is fine.
20:22Create. Copy. Back to aperture.
20:25Store it here.
20:28Models. We definitely want more models. So let's go back to open router.
20:37Let's maybe add 5.6 sol. Why not? Play small for OpenAI.
20:42Boom. Enter. Why is there what the nobody's using Llama 3.1.
20:49That is pretty sketchy selection here. Even these are outdated.
20:53Haiku, nobody's using Haiku. Guys, if you're using Haiku 4.5, please, you need to renounce your sense. This crazy.
21:00This list is absolutely crazy. Whatever. If anything, we wanna use, like, Q M K 88Point7 code.
21:05Right? If you want some fast, efficient models, Boom.
21:09We also would probably want the GLM 5.2. You know? Whatever.
21:13We can probably change this later as well. So I'm gonna screenshot this again. It should probably be all good, but let's confirm.
21:20All good now. Alright. Let's add the provider.
21:25Create access for the service doc. Okay. And do a quick test here.
21:32It's gonna test all three VPSs. Okay. Amazing.
21:35So let's do a screenshot.
21:38What now? Agent config in the left sidebar. There we go.
21:42There's no Hermes agent here.
21:47There is no Hermes agent. So since Hermes needs a OpenAI compatible endpoint, I'm gonna click on the Codex tab, and I'm gonna ask Codex if it has everything.
21:58Do you have everything to finish the Hermes agent setup? Yes or no? So get to work and finish it using Telescale and Aperture to manage our OpenRouter API key.
22:10Get to work. The setup for Hermes agent is still in the CMax pane. I will say the other CMax pane.
22:17Boom. So now we provided codecs with the info that it was missing, which namely is the open our API key.
22:24And this is gonna be stored securely on Aperture now. And by way, a bit more about Aperture. This is Telescale's AI gateway.
22:31So it also lets you run providers, but we're using it to store API keys securely. So it joins your Telenet as a node so that agents can reach it privately over Telescale. So your real API keys for OpenAI and for up Google or custom endpoints live in one place, never on individual machines.
22:47It's securely stored in Aperture. Or let's check on the setup here. As you can see, CMax I'm not doing anything.
22:53CMax allows codex to do all of the steps for the Hermes agent setup.
22:58So this is crazy. Right? Even the clicking, like, literally month or two ago, I would still be doing the clicking here, selecting the options, but we don't have to do any of that.
23:05We literally don't like, we just tell the goal to codex. And because I have it set up in Cmax, it can just do these steps, I literally have my hands off the keyboard, and it's able to progress through the setup, insert stuff, make selections, make decisions.
23:23It's really incredible. Okay. There we go.
23:25Seems like Hermes Asian installation is complete. I'm wiring its model provider to aperture and testing it. So the one thing that I noticed with this generation of latest AI models like Fable and GBT 5.6 is that they do a lot more tests, and you don't have to tell them this.
23:40Right? So anytime they do a change if you use the previous generation, it would just make the change. Right?
23:45Opus or GBD 5.5, they would do what you tell them, but they wouldn't really care about the results or the implications. Fable and GBD 5.6, they do care.
23:54They make a change and they figure out, okay, was this a breaking change? Is the performance good? You know, they run a few tests to see, like, does it work?
24:03Does it do the things that we wanted it to? Does it have any side effects? These models are way way smarter, and it's really incredible, and I do believe you can just build build anything.
24:12If you have good product intuition and a good vision and good taste, you can build anything. People complain about slop.
24:21Right? AI turning out slop. I completely disagree.
24:23I think 99% of slop is because of the humans. The humans don't know what to build. The humans using the AI have no taste.
24:30They have no experience of what it takes to make a great product. They don't have deep domain expertise to solve that very specific problem, and that's why they're churning out slop.
24:40It's because they're telling the AI to make slop, not because of the AI is not capable enough. If you're using Fable five, if you're using GPT 5.6 Sol, these models are more than capable to build any piece of software you want.
24:52You just need to know what to build and have the work ethic to build it. Alright. So now Codex is testing Hermes with aperture.
25:00We see aperture okay. Alright. It says setup complete.
25:03Hermes agent v zero eighteen installed. Model, GLM 5.2 request route through Aperture over tail scale. OpenAIR key is not stored on the VPS.
25:12End to end is returned. So now we can do Hermes. You can chat with Fate.
25:16Obviously, you can connect it to Discord, Telegram, all of that. I've shown you that in many different videos, and let's do the test ourselves. Who are you?
25:23I'm Hermes agent, AI assistant by News Research. Amazing. So I'm gonna say, are we still connected to the VPS through Telescale?
25:30Just to confirm, I know the answer is yes. Now I want you to change the model inside of Hermes agent to be GPT 5.6 Sol instead, not GLM 5.2.
25:43Do this change right now. Change the default model in Hermes. So, again, this would be something that you would have to do yourself.
25:49But with Tailscale, you can you know, anytime a new model comes out, let's say you have five different agents on five different VPSs or one of them is on a Mac studio, the other one is on a, you know, laptop, whatever. If you put all these devices on Telescale, all it takes is sending one prompt to your personal agent, and it can update all of your agents to the latest and greatest model, like, by itself.
26:10And you're saving twenty, thirty, forty minutes easily. I mean, the amount of times I spent thirty to sixty minutes just fixing some bullshit OpenClaw issue is more than I would like to admit.
26:20Right? And people know it, and this is why people switch away from agents like OpenClaw or Hermes. But with Telescale, a lot of these issues disappeared completely.
26:29And, again, my hands are lifted, guys. I need to stress this. I'm not doing this.
26:33I just told it my goal. Update the default model to g p d 5.6, and it's doing that itself.
26:39And end to end test passed. Okay.
26:41Amazing. So let's try it. So it it did the test itself again, but now I can do a manual test myself.
26:48What model are you? We already see it here, but, you know, I wanted to answer. Yeah.
26:54I'm running OpenAI's gbt pharmacy through her mess agent. Amazing. And if you wanna triple check this, we can literally go to open our logs, and we should see boom.
27:01Here we go. 5.6 SOL provider OpenAI, blah blah blah, tokens per second right here.
27:09And, yeah, it works. So we have set up brand new Hermes agent on a VPS. We have locked down the VPS, making it completely secure, only accessible via Telescale.
27:20We have used Codec CLI to install everything and to set it up, to change the model for us, and we're securely storing the API keys on Aperture. This already, just the contents in this one video, will already put you ahead of 99% of people in AI.
27:35Most of them have no idea what Tailscale is. Most of them are storing API keys insecurely. Most of them have VPS servers with open ports and, you know, disabled firewalls and all that stuff.
27:44If you actually do the steps, which I would highly recommend you go through it again and follow it. Right? If you just watched this video and you didn't implement it, go through it again and follow all these steps yourself.
27:53Do it for your own servers. Do it for your own agents. If you don't have a VPS, I already showed you how to get one from Hostinger and how to set it up.
28:01Please do these steps yourself. The future is gonna be full of agents.
28:05All of us are gonna be running ten, twenty, thirty, fifty, one hundred agents doing all kinds of different things for us. All of us are gonna be managing multiple different computers, multiple different VPSs.
28:15You need to get familiar with these technologies now. This is why I made this video about Telescale. And instead of, you know, talking about Telescale only, I made it specific to AI agents.
28:23How to use Telescale with AI agents because this is only the beginning. The decade of AI agents has begun.
The Hook
The bait, then the rug-pull.
Tailscale isn't pitched here as a privacy VPN — it's framed as the missing layer for anyone running more than one AI coding agent. The video's real subject is what happens when you combine that private network with an AI CLI agent: an entire VPS goes from freshly rented to fully locked down and running its own AI agent, driven almost entirely by plain-English instructions instead of typed commands.
Named ideas worth stealing.
00:30concept
Zero open ports
A VPS with no inbound ports exposed to the public internet is reachable only through the private Tailscale tunnel, removing the attack surface bots scan for.
Steal forAny self-hosted server or VPS running agents, APIs, or internal tools that don't need public inbound access.
03:23concept
Access Control Lists (ACLs)
Rules that restrict which devices or people on a tailnet can reach which other devices, containing a compromise instead of granting network-wide trust by default.
Steal forAny multi-agent or multi-team setup where one compromised machine shouldn't be able to reach everything else.
How they asked for the click.
VERBAL ASK
04:05product
“Get a VPS from Hostinger — first link below the video, code DAVID for an additional 10% off.”
Mid-roll sponsor segment folded directly into the tutorial: the VPS purchase IS the next tutorial step, so the pitch doubles as the setup walkthrough rather than reading as an interruption.
MENTIONED ON CAMERA
FROM THE DESCRIPTION
PRIMARY CTAWhere the creator wants you to go next.
OTHER LINKSAlso linked in the description.
Visual structure at a glance.
