Advanced

An always-on machine for your agent

This page is for readers whose agent already works on their own computer and who now want it to run schedules overnight or answer from a phone while they are out. Both of those need a computer that stays on, so this page covers three ways to get one: leaving an old laptop or a mini PC running at home, or renting a server in a data center.

Applies to: Agent Zero, Hermes Agent, OpenClaw, NanoClaw, Atomic Agent, QwenPaw, Eigent, and Everfern. Goose and OpenManus suit it poorly, for the reasons in the agent table below.

Settings, prices, and plan limits were checked on 14 November 2026.

Why the computer has to stay on

None of these agents runs on the company's computers unless you pay for a hosted plan. The agent, its schedules, and its gateway all live on whatever machine you installed them on, so when that machine sleeps, everything stops.

You can see this in each agent's design. Agent Zero runs its Tasks inside its container on your computer, so a task due while the computer is off does not run. Hermes Agent's docs say "the gateway also runs the cron scheduler," so its schedules stop whenever the gateway's computer sleeps. OpenClaw's phone apps do not contain the agent at all, because they connect back to a gateway on your computer, which must stay on and be reachable.

So a laptop you close every evening gives you an agent that only works while you are at the desk. That is fine for many people, and if it suits you, you can stop reading here.

Three ways to do it

A rented server is a virtual machine in a provider's data center, often called a VPS (virtual private server), which you reach over the internet and which usually runs Linux.

Option	Up-front cost	Monthly cost	Good for	The catch
Your everyday computer, left on	$0	Electricity only	Trying schedules and phone access before you commit	Privacy risk. The agent shares a computer with your own files and logins, and you cannot shut the lid.
An old laptop or a mini PC at home	A machine you own, or one you buy	Electricity only	A dedicated agent machine with nothing personal on it	Hardware dependent. An old machine can run the agent with a cloud model, but it cannot run a useful local model unless it has about 24 GB of memory.
A rented server (VPS)	$0	One example: DigitalOcean's Basic server with 4 GiB of memory, 2 virtual processors, and 80 GiB of storage is $24 a month. Automatic backups add 20% for weekly or 30% for daily.	Agents built for Linux servers, such as Hermes Agent, OpenClaw, and NanoClaw	Privacy risk. DigitalOcean gives each server a public internet address by default, so a mistake in setup opens the agent to the whole internet.
A hosted plan from the agent's maker	$0	Hermes Agent's Nous Portal Plus plan is $20 a month and includes one cloud agent with 4 GB of memory and 25 GB of disk.	Hermes users who do not want to run a server	Surprise bill. Included usage has daily, weekly, and monthly limits, and past them you can keep going on pay-as-you-go credits.

DigitalOcean is one example, not a recommendation, and this guide did not compare server prices across providers. A server at that size has no graphics chip and far too little memory for the local models on the local models page, so plan on a cloud model with a spend limit.

Power and cost at home

This guide could not confirm what any particular laptop or mini PC draws, because the research measured no power figures. You can work out your own cost with a plug-in power meter and one sum. For example, a machine that averages 20 watts uses 20 × 24 × 30 ÷ 1,000 = 14.4 kilowatt-hours in a 30-day month, which you then multiply by the price per kilowatt-hour on your electricity bill.

A machine running a local model draws more, because the chip works hard for the whole reply. The model's bill is usually the bigger cost anyway, since a schedule that runs every hour on a paid API key keeps spending whether you are watching or not.

Which agents suit it

Agent	How it keeps running	Phone access	Fit
Agent Zero	Docker, with Tasks for schedules. A community guide covers Linux servers.	Telegram or WhatsApp with an allow list, or its Flare tunnel	Good, at home. Its server guide puts the page on the public internet, which this page does not recommend.
Hermes Agent	`hermes gateway install` sets up a background service on Windows, macOS, and Linux	A chat bot through its gateway	Strong. Its docs cover servers, and Hermes Cloud is the hosted option.
OpenClaw	Its gateway is built to stay on	Chat apps, or its phone apps over Tailscale	Strong. Its docs name an always-on gateway on a home server or VPS, reached through Tailscale.
NanoClaw	A login service on macOS and a user service on Linux	Chat apps are the whole product	Strong on a Mac or Linux. Windows works only through WSL2.
Atomic Agent	Schedules, reminders, and an `overnight` mode	Telegram or Discord, limited to one owner	Fair. Overnight runs refuse anything that still needs a yes.
QwenPaw	Schedules, plus a Docker image for servers	Many chat apps	Fair. A run with nobody present may log a dangerous action and carry on.
Eigent	A desktop app with scheduled automations	A Remote Control page. This guide could not confirm the WhatsApp steps.	Fair, on a home machine that stays signed in.
Everfern	A desktop app with scheduled actions	None in its README	Weak for phone use, fair for schedules at home.
Goose	Scheduled recipes. This guide could not confirm they run after you sign out or the computer sleeps.	Its Telegram gateway names no sender allow list, so leave it off.	Weak.
OpenManus	You type each task in a terminal	None	Poor. Its README has no schedules and no chat apps.

Set up an old laptop or mini PC at home

These steps assume Windows 11 or a Mac, with the agent already installed and working from its own guide. Do them in order, because each one fixes a different way the agent can stop.

1. Use an ordinary account with nothing personal in it

Sign in to the machine with an ordinary account, not an administrator account. If you can, use an account that is not signed in to your personal email, cloud storage, or password manager, because the agent can reach whatever that account can reach.

Never run the agent as an administrator. Hermes Agent's checklist says never to run its gateway as root, the Linux name for the administrator, and on any agent an administrator account makes every approval an administrator-level approval.

What you should see the agent working while you are signed in to an ordinary account, with no personal email or cloud storage signed in on that account.

2. Stop the machine from sleeping

On Windows 11:

Open Settings, then System, then Power & battery, and expand Screen, sleep, & hibernate timeouts.
Set Make my device sleep after to Never for When plugged in. The screen can still turn off.
On a laptop, open Control Panel, select System and Security, then Power Options, then Choose what closing the lid does, and set When I close the lid to Do nothing under Plugged in. Click Save changes.

On a Mac laptop, open System Settings, click Battery, click Options, and turn on Prevent automatic sleeping on power adapter when the display is off. Keep the lid open, because Apple's closed-lid mode needs an external display, keyboard, and mouse as well as power. On a Mac desktop, open System Settings, click Energy, and turn on Prevent automatic sleeping when the display is off.

What you should see the machine still awake an hour later with the screen off, and the agent still answering.

Note: Keep a laptop plugged in. With sleep turned off and no charger, the battery simply runs down.

3. Make everything start again after a restart

Windows installs updates and restarts by itself. For updates released on or after 28 July 2026, Microsoft is gradually moving home PCs to one restart a month, and the restart happens outside your active hours whenever possible. You set those hours under Settings → Windows Update → Advanced options → Active hours, though urgent updates can still install right away.

After any restart, several parts start only when someone signs in. Ollama and Docker Desktop are sign-in items, and Hermes Agent's Windows service runs at sign-in too. So after a restart, sign in to the machine again, or the agent stays off.

In Docker Desktop, open Settings, then General, and turn on Start Docker Desktop when you sign in to your computer. It is off by default.
For Hermes Agent, run hermes gateway install once. On Windows this registers a task that starts the gateway at sign-in, and on a Mac it installs a background service.
For Agent Zero, this guide could not confirm whether Launcher starts the container again by itself, so after every restart, open Launcher and check that it says Running.

What you should see after you restart the machine and sign in, the agent answering again without you starting anything except Launcher.

4. Keep it off the internet

The rule is simple: no part of the agent should be reachable from the public internet. Do not forward any port on your home router to this machine.

Agent Zero's recommended setup already follows that rule, because its page listens only on 127.0.0.1, which is this computer and nothing else. Keep it that way. Agent Zero's installer project also shows a shorter docker run command for port 80 that is not limited to 127.0.0.1. Docker's own docs say a published port listens on every network connection unless you limit it, so do not use that command.

A chat bot does not need an open port either. Agent Zero's Telegram plugin, for example, supports a polling mode, in which the agent reaches out to Telegram for new messages and nothing has to reach in.

What you should see no port forwarding rule for this machine in your router's settings, and Agent Zero's page opening at http://localhost:5080 on the machine itself.

5. Reach it from your phone privately

You have two private options. The first is a chat bot with an allow list that holds only your own account, set up from your agent's own guide, such as Agent Zero's Telegram or WhatsApp plugins or a Hermes Agent gateway.

The second is Tailscale, which makes a private network, called a tailnet, between devices you sign in with your own account. Tailscale's free Personal plan allows up to 6 users and unlimited user devices, such as computers and phones. A page you share this way can be opened only from your own signed-in devices, so it stays off the public internet.

Install Tailscale on the always-on machine. On Windows, download the installer from tailscale.com/download and run it. Then select the new Tailscale icon in the system tray and, under your account, select Log in. On a Mac, Tailscale recommends its Standalone version, which needs macOS Ventura 13 or newer. To use its tailscale command, open its Settings and install the CLI integration.
Install the Tailscale app on your phone and sign in with the same account.
On the always-on machine, share the agent's web page with your tailnet. For Agent Zero on port 5080, run this in PowerShell or Terminal:

tailscale serve --bg 5080

If the command asks you to turn on HTTPS for your tailnet, follow its link and agree.

What you should see Tailscale prints Available within your tailnet: and an address ending in .ts.net. That address opens the agent's page on your phone while Tailscale is on, but not on a device outside your tailnet, and the --bg flag keeps it shared after a restart.

Warning: Use tailscale serve, never tailscale funnel. Funnel publishes the page to the whole internet.

How well this is documented depends on the agent. OpenClaw supports Tailscale directly: with gateway.bind left at "loopback" and gateway.tailscale.mode set to "serve", or with openclaw gateway --tailscale serve, its gateway stays on 127.0.0.1 while Tailscale handles the private address. Agent Zero's docs do not mention Tailscale, since its own route to a phone is the Flare tunnel. Tailscale Serve works with any page on a local port, but this guide could not confirm that Agent Zero has been tested with it, so set Agent Zero's login first, as the next step describes.

The agent's own page. In Agent Zero, open Settings → Authentication and set UI Login and UI Password before you use Tailscale or the Flare tunnel. Its installation guide says: "Always set a username and password in Settings -> Authentication before creating a tunnel to secure your instance on the internet." If you installed with a username but no password, Agent Zero's installer set the password to 12345678, so change it.
OpenClaw's gateway. Its default sign-in is a token. Keep it, and do not set gateway.auth.mode to none.
Your Tailscale account. Tailscale has no password of its own, because you sign in through an account such as Google, Microsoft, Apple, or GitHub. Turn on two-step verification for that account, since anyone who gets into it can join your tailnet.
Chat bots. Keep the allow list to your own account. On Hermes Agent, never set GATEWAY_ALLOW_ALL_USERS=true, and on OpenClaw, leave direct messages on pairing and never set dmPolicy to open.
Your model bill. Set a spend limit with your provider, because a schedule keeps spending while you sleep.

What you should see a login screen when you open the agent's page from your phone, and a chat bot that ignores messages from anyone else.

A rented server instead

A server suits agents that are built to run on Linux and talk through chat apps, which means Hermes Agent, OpenClaw, and NanoClaw. It is a bigger job than a machine at home, because you manage a Linux system through a terminal, and it is on the internet from the moment it starts. Do not try it as your first project.

The same rule applies: nothing about the agent should be reachable from the public internet. Tailscale's docs cover Linux servers, so you can join the server to your tailnet and reach it only from there.

Create the server with your provider, then connect to its terminal using the provider's instructions.
Install Tailscale and sign in:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Open the sign-in address that tailscale up prints, and sign in with your Tailscale account.
Turn on Tailscale SSH, so that you can reach the server's terminal through your tailnet:

tailscale set --ssh

What you should see the server listed on the Machines page of Tailscale's admin console, and a terminal connection to it working from a computer on your tailnet.

Only after that works should you close the server's public terminal access, using your provider's firewall. The steps differ by provider, and this guide could not confirm them for each one. If you close it before Tailscale works, you can lock yourself out.

Warning: On a Linux server, Docker's own docs say a published container port gets around the ufw firewall entirely. A firewall rule does not protect a container started with a plain -p 50080:80, so publish ports only on 127.0.0.1, as in -p 127.0.0.1:5080:80, and share them with tailscale serve.

Notes for each agent on a server:

Hermes Agent. Run hermes gateway install, then sudo loginctl enable-linger $USER once, so the gateway keeps running after you sign out. Its docs say that for a server you never sign in to, this gives the same start-at-boot behavior with no root involvement, even when hermes update restarts the gateway.
OpenClaw. Its remote-access docs name an always-on gateway in your tailnet on a VPS or home server as a standard setup, with gateway.bind kept at "loopback" and Tailscale Serve for the control page.
Agent Zero. Its server guide was last updated on 21 December 2025 and lists its author as "Auto-generated from deployment experience." It asks for at least 2 GB of memory and 20 GB of storage, and it recommends 4 GB and 50 GB or more. That guide puts the page on a public domain behind a login, and it publishes the container port without 127.0.0.1. This page does not walk through it. If you follow it anyway, fill in its AUTH_LOGIN and AUTH_PASSWORD settings before the page goes live, so that the public address at least asks for a login.

Updates and backups

An always-on machine needs looking after, because nobody notices when it quietly breaks.

Updates. Run hermes update regularly, which Hermes Agent's checklist recommends for security fixes. Goose updates with goose update. Ollama on Windows and Mac downloads its own updates, which you apply by clicking its icon and choosing Restart to update. OpenClaw checks for a new version daily unless you set update.checkOnStart to false.
A weekly check. Once a week, ask the agent a question from your phone and look at the last run of each schedule. A schedule that silently failed for a month is the usual surprise.
Backups. Agent Zero's Time Travel feature can roll back workspace files, but its README says it "is not a replacement for Git or backups." This guide could not confirm official steps for backing up Agent Zero's data on Windows or Mac.
Backups hold secrets. OpenClaw keeps its keys and tokens in ~/.openclaw, and its docs do not describe that folder as encrypted, so keep it out of any shared or cloud-synced folder. Hermes Agent keeps its keys in ~/.hermes/.env, and its checklist says never to commit that file to version control.

What you should see after your first weekly check, every schedule showing a recent run, and the agent answering from your phone.

Trade-offs: safety versus capability

Leaving your everyday computer on. You change only its sleep settings, and the agent keeps running on the same account you use every day.

You gain: schedules and phone access with no new hardware and no setup beyond sleep settings.
You risk: the agent, and anyone who tricks it with a prompt injection, can reach whatever your own account can reach, around the clock.
Makes sense when: the agent stays in its container or one backed-up folder, with host access off. If the agent needs host access, a separate machine makes more sense.

A dedicated machine at home. An old laptop or mini PC runs only the agent, under an account with nothing personal in it.

You gain: the agent cannot reach your personal files or logins, because they are not on that machine.
You risk: another computer to update, and one that runs unwatched, so a broken schedule or a stuck loop can go on for days.
Makes sense when: you already use schedules or a phone bot on your main computer and want them to keep going at night. Pair it with a spend limit.

A rented server. A VPS keeps the agent running even when your home internet or power goes out.

You gain: the best uptime, and agents such as Hermes Agent and OpenClaw are built for it.
You risk: the server is on the public internet from the start, so one wrong port setting exposes the agent to everyone, and every running hour costs money.
Makes sense when: you are comfortable in a Linux terminal and join the server to Tailscale before anything else. It does not make sense for a beginner.

Reaching the agent's page from your phone. Tailscale Serve, Agent Zero's Flare tunnel, and a public reverse proxy all put the full page on your phone.

You gain: the whole page, with its files and settings, from anywhere.
You risk: Agent Zero's docs say anyone with its tunnel address can try to open the page, and a public domain is open to the whole internet. Tailscale limits it to your own devices, but only while your Tailscale account stays secure.
Makes sense when: the page has its own strong login and you use Tailscale Serve rather than Funnel. Most people only need a chat bot limited to their own account.

Turning off Tailscale key expiry. Tailscale signs devices out after a set time, and you can turn that off for a server so it never drops off your tailnet.

You gain: a server that stays reachable without you signing it back in.
You risk: Tailscale warns that this reduces security if the device or its key is ever stolen.
Makes sense when: the machine is a server you control and you would notice if it went missing. Leave expiry on for laptops.

For the three questions behind these choices, see Safety versus capability.