Fixie gives you a static IP address for your Hermes agent so outbound HTTP and HTTPS requests can reach services that require IP whitelisting.

Use this setup when Hermes needs to call a private API, webhook endpoint, SaaS admin API, internal tool, or any third-party service that only accepts traffic from approved IP addresses. Hermes runs through Fixie, and the remote service sees your Fixie static IP addresses instead of the changing IP address of your laptop, gateway, container, or remote execution backend.

This page is for HTTP and HTTPS requests from Hermes. For databases, SSH, SFTP, FTP, and other raw TCP connections, use Fixie Socks with a SOCKS-aware client or fixie-wrench.

1. Create a Fixie HTTP/S proxy

Create a Fixie HTTP/S proxy in the Fixie Dashboard, then copy its proxy URL. It will look like:

http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80

Each Fixie proxy group has two static IP addresses. Add both IP addresses from the Fixie dashboard to the allowlist for the service your Hermes agent needs to call.

2. Add Fixie to the Hermes environment

Hermes reads environment variables from the process environment and ~/.hermes/.env. Put the proxy variables in the Hermes environment file so the gateway and compatible tools can inherit them:

hermes config env-path

Then add these values to the printed .env file:

FIXIE_URL=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
HTTP_PROXY=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
HTTPS_PROXY=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
http_proxy=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
https_proxy=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
ALL_PROXY=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
NO_PROXY=localhost,127.0.0.1,::1
no_proxy=localhost,127.0.0.1,::1

Restart the running Hermes gateway or process manager after changing the environment file.

For an interactive shell session, you can also start Hermes from a shell where the variables are already exported:

export FIXIE_URL="http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80"
export HTTP_PROXY="$FIXIE_URL"
export HTTPS_PROXY="$FIXIE_URL"
export http_proxy="$FIXIE_URL"
export https_proxy="$FIXIE_URL"

hermes chat

3. Configure Docker or remote backends

If Hermes itself runs in Docker, pass the proxy variables to the container:

docker run -it --rm \
  -v ~/.hermes:/opt/data \
  -e FIXIE_URL="$FIXIE_URL" \
  -e HTTP_PROXY="$FIXIE_URL" \
  -e HTTPS_PROXY="$FIXIE_URL" \
  -e ALL_PROXY="$FIXIE_URL" \
  nousresearch/hermes-agent

If Hermes executes terminal commands inside Docker, SSH, Modal, or another remote backend, set the proxy variables inside that execution environment too. Setting them only on the Hermes gateway host will not automatically proxy commands that run somewhere else.

Hermes also has channel-specific proxy settings. Use these only when you want the messaging connection itself to egress through Fixie:

TELEGRAM_PROXY=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80
DISCORD_PROXY=http://fixie:YOUR_TOKEN@YOUR_SUBDOMAIN.usefixie.com:80

4. Verify the static IP address

Run a request from the same Hermes environment that will call the whitelisted service:

curl --proxy "$FIXIE_URL" http://welcome.usefixie.com
curl https://api.ipify.org

The first command verifies explicit Fixie proxy use. The second command verifies that the current shell environment is honoring the proxy variables.

Troubleshooting Hermes static IP requests

If the remote service still sees the wrong IP address:

• Confirm both Fixie static IP addresses are on the remote service's allowlist.
• Confirm Hermes was restarted after the environment changed.
• Check whether the request runs in a local shell, Docker container, SSH backend, Modal backend, or other remote execution environment.
• Check both uppercase and lowercase proxy variable names.
• Check NO_PROXY and no_proxy; any matching host bypasses Fixie.
• For raw TCP use cases, switch to Fixie Socks or fixie-wrench.