Two smooth graphite nodes connected through three luminous security rings — Remote A2A should widen one boundary at a time: authenticate, bind deliberately, advertise the correct route, and verify from the peer network.

Expose Hermes A2A Locally, Remotely, or Behind a Proxy

Hermes keeps an unauthenticated A2A server on 127.0.0.1. Remote exposure requires a bearer token and an explicit A2A_HOST. This fail-closed sequence prevents a copied host-binding setting from silently publishing an unauthenticated agent.

Official documentation: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/a2a

Separate four network decisions

The bind address controls where the server listens. Authentication controls which peers may submit tasks. The advertised URL tells clients where the Agent Card says the agent can be reached. A reverse proxy or Kubernetes service may provide the externally routable path.

Set A2A_PUBLIC_URL when the bind address is not the URL peers should call. The server may also derive an advertised route from forwarded host and protocol headers, but proxy trust and TLS termination policy are not described in the A2A excerpt. Use the networking platform's official guidance rather than inventing those guarantees.

Remote callers reach the same live Hermes gateway session, memory, and enabled tools. Treat internet reachability as a consequential expansion even when prompt filtering and rate limits are present.

Exposure checklist

Prove loopback behavior first.
Configure a bearer or per-peer token before widening the host.
Restrict trusted peers and keep allow-all disabled.
Set a routable A2A_PUBLIC_URL where needed.
Confirm the Agent Card advertises the intended URL.
Apply network-layer TLS and firewall policy outside the undocumented app details.
Test from the actual peer network, not only localhost.

Common pitfalls

Publishing 0.0.0.0 as a standalone setup step. Authentication must come first.
Confusing bind address with advertised URL. A reachable listener can still publish an unusable card.
Assuming bearer auth supplies transport encryption. Authentication and TLS are separate.
Exposing an owner profile without reviewing its tools. Remote input can reach that profile's live capabilities.

Verification

Fetch the canonical Agent Card locally, then from one authorized peer network. Verify an invalid token receives 401 Unauthorized, an untrusted identity is rejected, and the card URL resolves to the intended endpoint. Review the audit log and gateway errors after the test, then remove temporary exposure rules that are no longer needed.