---
title: Headless Server
type: system
status: active
created: 2026-07-22
updated: 2026-07-22
verified_on: 2026-07-22
confidence: high
tags: [system, browser]
sources: [raw/configs/hermes-config-sanitized.txt]
---

# Headless Server

## Purpose
Headless X11 environment backing Hermes's browser automation and any GUI tooling.

## Location
- **Host:** this container (ct460, `hermes`), no separate VM/LXC — headless stack runs directly alongside the agent.
- **Display:** `Xvfb :99`, resolution `1600x1200x24`, started with `-ac -nolisten tcp`

## Current configuration (verified via `ps aux`, 2026-07-22)
| Process | Detail |
|---|---|
| `Xvfb` | `:99 -screen 0 1600x1200x24 -ac -nolisten tcp` |
| `fluxbox` | window manager on `:99` |
| `x11vnc` | `-display :99 -forever -shared -rfbport 5901 -rfbportv6 5901 -noxdamage -quiet -nopw` — **no VNC password set** |
| `websockify` ×2 | `127.0.0.1:6080 → 127.0.0.1:5900` and `127.0.0.1:6081 → 127.0.0.1:5901`, serving noVNC (`/usr/share/novnc`) |

Two VNC/websockify pairs exist (5900/6080 and 5901/6081) — the second (`:99`→5901→6081) is the one confirmed above; the first (5900→6080) predates it and wasn't independently re-verified this pass — **unresolved** whether it's a second live display or a leftover process.

## Connected systems
- [[systems/hermes-agent]] (browser backend uses this display — see [[systems/browser-backend]] / [[comparisons/camoufox-vs-chrome]])
- [[infrastructure/hosts]]

## Known issues
- `x11vnc -nopw`: VNC is unauthenticated. It's bound to all interfaces (`0.0.0.0:5901` and `[::]:5901`), not just loopback — reachable from the LAN and, if any tunnel/firewall rule forwards it, potentially beyond. Worth restricting to loopback or adding `-passwd`/`-rfbauth` if this hasn't been a deliberate choice.

## Relevant runbooks
- [[runbooks/restart-browser]]