# Remote Desktop No-Auth Setup — 2026-06-14

## Environment

- **Backend host:** debian-ai (192.168.1.50, Tailscale 100.126.244.3)
- **Desktop host:** CachyOS (192.168.1.111, user raymond, fish shell)
- **Dashboard port:** 9119

## Symptom

Hermes Desktop on CachyOS boot-loops: starts local backend → "resolving Hermes backend" → "Your remote gateway session has expired" → restart.

```
[hermes] [boot] Resolving Hermes backend
[hermes] [boot] Desktop boot failed: Your remote gateway session has expired.
                          Open Settings → Gateway and click "Sign in" again.
[hermes] [boot] Restarting desktop connection
```

The loop repeats until the user kills the process.

## Root Cause

Three issues stacked:

1. **Dashboard was not running on the backend** — `ss -tlnp | grep 9119` returned nothing.
2. **`connection.json` had `"mode": "local"`** — Desktop ignores the `remote` block entirely and tries to start its own local backend.
3. **User doesn't want auth login friction** — Basic Auth required sign-in via the Desktop UI, which kept failing.

## Fix Sequence

### Step 1: Start the dashboard on the backend

```bash
fuser -k 9119/tcp 2>/dev/null
env -u HERMES_DASHBOARD_BASIC_AUTH_USERNAME -u HERMES_DASHBOARD_BASIC_AUTH_PASSWORD \
    hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure
```

### Step 2: Verify dashboard is up

```bash
ss -tlnp | grep 9119
# Should show: LISTEN 0 2048 0.0.0.0:9119 ...
curl -s http://127.0.0.1:9119/api/status | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['auth_required'])"
# Should print: False
```

### Step 3: Fix connection.json on CachyOS (via SSH)

```bash
ssh raymond@192.168.1.111 'bash -s' <<'SSH_EOF'
cat > ~/.config/Hermes/connection.json << 'CONF'
{
  "mode": "remote",
  "remote": {
    "url": "http://100.126.244.3:9119",
    "authMode": "token",
    "token": {
      "encoding": "plain",
      "value": ""
    }
  },
  "profiles": {}
}
CONF
SSH_EOF
```

### Step 4: Kill stale backend on CachyOS

```bash
ssh raymond@192.168.1.111 'bash -s' <<'SSH_EOF'
pkill -f "hermes.*dashboard" 2>/dev/null
fuser -k 9120/tcp 2>/dev/null
rm -f ~/.hermes/logs/desktop.log
SSH_EOF
```

### Step 5: Launch Hermes Desktop from the KDE menu

Desktop connects directly — no sign-in needed.

## Key Commands

| Action | Command |
|--------|---------|
| Start dashboard (no auth) | `env -u HERMES_DASHBOARD_BASIC_AUTH_USERNAME -u HERMES_DASHBOARD_BASIC_AUTH_PASSWORD hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure` |
| Check dashboard | `curl -s http://127.0.0.1:9119/api/status` |
| Check auth state | `curl -s .../api/status \| python3 -c "import sys,json; d=json.load(sys.stdin); print('auth_required:', d['auth_required'])"` |
| Kill dashboard | `fuser -k 9119/tcp` |
| Kill Desktop backend | `fuser -k 9120/tcp` |
| Check Desktop log | `tail -50 ~/.hermes/logs/desktop.log` |
| Connectivity test | `timeout 3 bash -c 'echo > /dev/tcp/<backend-ip>/9119' && echo OK || echo BLOCKED` |
| Disable basic auth | `sed -i 's/^HERMES_DASHBOARD_BASIC_AUTH_USERNAME=/#HERM...E=/' ~/.hermes/.env` |
| SSH to CachyOS | `ssh raymond@192.168.1.111` (user is `raymond`, not `rurouni`) |