# Session Summary — 2026-07-12 — VPS Gateway Stabilization

## Objectives
- Stop the unstable local gateway triad on the Hostinger VPS (2.25.172.164) that was causing token collisions and bot flapping.
- Make the VPS Web UI (https://2.25.172.164) the single source of truth for the messaging gateway.
- Confirm the Windows Desktop (PS C:\Users\Rob) is just a client with no local gateway duties.
- Establish a stable foundation so downstream "model selection issues" (which were actually gateway-thrash symptoms) clear up.
- Use Nous as the primary provider for free web tools, manage inference costs from that platform.

## Decisions made
- **Architecture: VPS-only gateway.** The VPS at 2.25.172.164 (Hostinger, original Hermes install) is the single source of truth. The Windows Desktop runs only the Hermes Desktop app (5 Hermes.exe processes are normal Electron renderer/GPU/helpers) — no gateway/service runs there.
- **The `hermes serve` on the VPS's 127.0.0.1:9119 stays.** It is the TUI session's own local backend (child has `--session-key 20260712_053447_6b5a35`); it is NOT the bot gateway. Do not kill it or this TUI breaks.
- **Stop sequence order matters:** kill manual gateway PIDs first (so the lock is free), then disable systemd, then kill the dashboard. Otherwise systemd's `Restart=always` loop respawns the manual one.
- **Drive the VPS via the Web UI** (https://2.25.172.164), not the CLI. CLI `hermes gateway stop` cannot be run from inside the gateway process (would kill the running shell).

## Configuration changes

**Runtime/process state on the VPS:**
- Manual gateway launcher PIDs 1994597, 1994598 — killed.
- Stray dashboard PID 1994625 — killed.
- Systemd unit `/etc/systemd/system/hermes-gateway.service` — `disabled` and `inactive`.
- New gateway started via Web UI: PID 2002803, `running`, both Telegram and Discord `connected` (Discord as `Jarvis -My Hermes Bot#3312`).
- One-time Telegram polling conflict warning (1/5) at 06:25:39 — self-resolving, expected when a previous Telegram long-poll hasn't expired yet.
- Port 9119: TUI backend only (PID 2002662, parent=PID 1, child `--session-key 20260712_053447_6b5a35`).
- Port 443/80: nginx in front of the dashboard.
- `*** System restart required ***` banner still present (Ubuntu nag) — not blocking, schedule a VPS reboot when convenient.

**Persistent memory entries written (4 entries, 1,993/2,200 chars used):**
- `memory`: VPS architecture (Hostinger = single source of truth, gateway stopped + systemd disabled, recovery procedure, TUI 9119 is the local backend, do not kill).
- `user`: User's primary Desktop is Windows (PowerShell), Hermes Desktop app path, VPS admin via Hostinger web terminal only, no SSH keys from Windows. Default to PowerShell syntax; only use Linux/bash when explicitly on the VPS.
- `user`: Prefers thorough correct work over quick patches ("let's do it right and be done with it"). Values honest admission of limits. Style: casual lowercase, abbreviated; respond in kind but stay precise.
- `user`: Goal is to use Hermes Desktop almost exclusively, rely on Nous provider for free web tools, manage inference costs from that platform. Gateway instability was the root cause of "model selection issues" they experienced.

## Files edited
- **None.** No project files, configs, or scripts were modified. All changes were process-level (kills, systemd state) and persistent memory entries.

## Outstanding issues
- **VPS has not been rebooted.** "System restart required" Ubuntu nag persists. Not blocking, but a clean reboot would clear kernel update state and any stale locks.
- **Telegram polling conflict warning was last seen at 06:25:39, retry (1/5).** Should self-resolve within ~2 min; not re-verified after that window. If the warning persists, the bot is being polled by something else and needs investigation.
- **Desktop's gateway URL not verified.** The Hermes Desktop app's local "remote gateway" setting was not checked — assumed to be `https://2.25.172.164`, but if it was pointed at the now-dead `http://127.0.0.1:9119` it will fail to connect.
- **Cert on the VPS dashboard is self-signed.** Expiry not checked. If it rotates/expires, Desktop TLS to the VPS will fail silently.
- **Nginx proxy path to the VPS dashboard was not exercised under load.** Stability surface for day-to-day Desktop use; not stress-tested.
- **One-time accidental secret paste** in this session (long opaque string, "mistake, ignore"). Memory note about it was removed to stay under the 2,200-char limit. If you want it back as a durable watch-item, say so and I'll re-add it.

## Next steps
1. **Wait ~2 min** after the Web UI START, then re-check the Web UI for both Telegram and Discord showing `connected` (green). The polling-conflict warning should clear on its own.
2. **Verify Desktop is pointed at the VPS.** In the Hermes Desktop app, confirm the remote gateway URL is `https://2.25.172.164` (not a localhost/9119 endpoint).
3. **Send a test Telegram message** (or Discord slash command) end-to-end. This is the real proof the single-instance setup works under traffic.
4. **Schedule a VPS reboot** at a low-traffic time via the Hostinger panel to clear the restart nag and any kernel patches.
5. **Check VPS dashboard cert expiry** (in the browser, click the cert icon in the URL bar, or use `openssl s_client -connect 2.25.172.164:443 < /dev/null 2>/dev/null | openssl x509 -noout -dates` from the Hostinger terminal).
6. **Bookmark the dashboard** at https://2.25.172.164 — accept the self-signed cert once and the browser will trust it for the session.

## Recovery procedure (if it ever comes back)
From the Hostinger web terminal on the VPS:
```bash
# Find the manual gateway PIDs
ps -ef | grep "hermes.*gateway" | grep -v grep
# Kill them
kill -9 <pid>
# Disable systemd
systemctl disable --now hermes-gateway.service
# Restart cleanly via Web UI Start button
```

---

Session ID: 20260712_053447_6b5a35
Model: minimax/minimax-m3 (Nous)
Platform: tui
User: Rob (rkblake@gmail.com)
VPS: 2.25.172.164 (Hostinger, original Hermes install)