Headless Server
Purpose
Headless X11 environment backing Hermes’s browser automation and any GUI tooling.
Location
- Host: this container (ct460,
hermes), no separate VM/LXC — headless stack runs directly alongside the agent. - Display:
Xvfb :99, resolution1600x1200x24, started with-ac -nolisten tcp
Current configuration (verified via ps aux, 2026-07-22)
| Process | Detail |
|---|---|
Xvfb | :99 -screen 0 1600x1200x24 -ac -nolisten tcp |
fluxbox | window manager on :99 |
x11vnc | -display :99 -forever -shared -rfbport 5901 -rfbportv6 5901 -noxdamage -quiet -nopw — no VNC password set |
websockify ×2 | 127.0.0.1:6080 → 127.0.0.1:5900 and 127.0.0.1:6081 → 127.0.0.1:5901, serving noVNC (/usr/share/novnc) |
Two VNC/websockify pairs exist (5900/6080 and 5901/6081) — the second (:99→5901→6081) is the one confirmed above; the first (5900→6080) predates it and wasn’t independently re-verified this pass — unresolved whether it’s a second live display or a leftover process.
Connected systems
- hermes-agent (browser backend uses this display — see browser-backend / camoufox-vs-chrome)
- hosts
Known issues
x11vnc -nopw: VNC is unauthenticated. It’s bound to all interfaces (0.0.0.0:5901and[::]:5901), not just loopback — reachable from the LAN and, if any tunnel/firewall rule forwards it, potentially beyond. Worth restricting to loopback or adding-passwd/-rfbauthif this hasn’t been a deliberate choice.