# Netplane: Hermes Agent plugin

> Install, configure and operate a self-hosted Headscale control plane from Hermes. netplane_setup previews a configuration and, after approval, installs the pinned official Headscale v0.29.6 DEB on a fresh…

Canonical: https://hermeswatcher.com/plugins/netplane  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/netplane  
Last updated in catalog: 2026-10-29

Install, configure and operate a self-hosted Headscale control plane from Hermes. netplane_setup previews a configuration and, after approval, installs the pinned official Headscale v0.29.6 DEB on a fresh Debian 12+ or Ubuntu 22.04+ systemd host (amd64/arm64). Installation runs on the Hermes host, requires root or noninteractive sudo, refuses existing deployments, and verifies the package SHA-256. It configures SQLite, MagicDNS, embedded DERP/STUN, local admin gRPC, and either Let's Encrypt HTTPS or a loopback backend for an existing reverse proxy. It starts the system service, creates the first user, and saves a 90-day API key and connection settings through Hermes's active-profile APIs. netplane_status reports health, netplane_nodes lists devices, and netplane_preauth lists metadata without stored join secrets or creates an approval-gated, single-use-by-default join key with a 1–168 hour lifetime. Desktop includes setup preview/confirmation, health, nodes, join keys and confirmed node expiration, with a FastAPI backend. Management requires NETPLANE_APIKEY; setup works before a key exists. Bundled protobuf stubs use pinned sources and a compatible toolchain.

## Good to know before installing

The netplane_setup tool (after Hermes approval) and the Desktop pane (after confirmation) install the pinned official Headscale v0.29.6 DEB as root through noninteractive sudo on the Hermes host, downloading it from GitHub (SHA-256 verified) and possibly contacting configured APT repositories; it writes /etc/headscale, /var/lib/headscale and a systemd drop-in, and enables a persistent headscale service that in Let's Encrypt mode listens publicly on TCP 80/443 and UDP 3478 (admin gRPC and metrics stay on loopback); Let's Encrypt receives the chosen domain and email; setup saves a new 90-day Headscale API key as NETPLANE_APIKEY in the active Hermes profile; management reads credentials only from Hermes and uses TLS with system trust off-host; approved join-key creation returns the key into the chat; status runs systemctl is-active headscale and tailscale serve status; no telemetry and no automatic software updates.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.

```bash
hermes plugins install netplane
```

2. Said no? Turn it on later:

```bash
hermes plugins enable netplane
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Security & privacy
- Maintained by: lEWFkRAD (Community)
- Needs: No API keys declared
- Requires Hermes: `>=0.21.6`
- Version: 0.3.1
- In the catalog since: 2026-10-29

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/netplane)
- [Source code](https://github.com/lEWFkRAD/netplane#readme)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt