Connect an agent to RN through a restricted network

Create a specific model access channel

A container on a bridge network can usually reach other destinations. Binding a service only to localhost does not restrict the connections it starts. In this series, the Hermes agent used --network none and the interface used a private Bubblewrap network.

The agent's only external route crossed a Unix socket to a trusted host relay. That relay had a fixed destination: rota-nacional.ia.br:443. It offered no open proxy, caller-selected host or caller-selected destination resolution.

Build the channel in three parts

• Create a private host directory with mode 0700. Open the transport Unix socket there. Use systemd-socket-activate to give the listener to systemd-socket-proxyd, with destination rota-nacional.ia.br:443 and --connections-max=64.
• Mount only that directory in the container. Inside the isolated network, open a 127.0.0.1:443 listener that forwards to the Unix socket. Use binaries and libraries compatible with the image.
• Map rota-nacional.ia.br to 127.0.0.1 only inside the container. The SDK keeps the original hostname. TLS crosses the relay without terminating there.
• Verify the certificate for rota-nacional.ia.br. The host resolves the destination through its authorized resolver. Do not use verify=false or replace the server certificate with a relay certificate.
• Keep a separate private socket for Desktop → agent. Do not combine that authenticated channel with RN access.

Register a dedicated key in Hermes

In Hermes Desktop v0.22.6, open Settings → Providers → Custom Endpoints. Initial onboarding offers I have an API key → Local / custom endpoint. Use an RN key from the organization responsible for this agent. Do not enter the provider secret or an administrative key.

To preserve the native OpenAI contract, use base URL https://rota-nacional.ia.br/v1/providers/openai/v1. Choose the API mode needed by the workflow, such as Chat Completions or Responses API, and a model available in the authorized pool. The gateway preserves provider bodies, parameters and errors.

The agent can access its registered credential. Restrict its authority and check the organization's available limits. Before repeating a request with a lost response, check its state. A broken connection does not prove that the provider did not execute it.

Decide when to require the privacy barrier

The /v1/providers/* path is native and does not anonymize content. RN still controls authentication and the authorized pool, but preserves the submitted body. If the organization or pool requires the barrier, this path returns 403 organization_privacy_barrier_required.

For protected chat, use base https://rota-nacional.ia.br/v1, Chat Completions mode and a rota/* model from the catalog. Check tool and streaming compatibility before switching. Do not assume that Responses-only or provider-specific features will be converted.

The content policy can replace, remove or block detected data. Coverage has limits. It does not guarantee protection against every sensitive value, malicious instruction or external action. Content storage and permission for external transmission are separate controls.

Check the network, then the useful workflow

Try a host service, the local network and the internet outside the channel. Those attempts must fail. Check RN TLS through the authorized route. Check that agent configuration is refused without a token and readable with the correct token.

After registering a key, test a synthetic conversation, the required tool call and expected errors. This local installation proved channels and the interface, but did not run inference because it had no dedicated key. An open TLS connection does not prove a completed conversation.

A fixed destination reduces the places a package can reach. It does not prevent abuse of an operation permitted by RN. The model must not receive broad authority to send messages, delete files or write to company systems.

Frequently asked questions