agent-estate-wiki/systems/headless-server.md

title, type, status, created, updated, verified_on, confidence, tags, sources

title	type	status	created	updated	verified_on	confidence	tags	sources
Headless Server	system	active	2026-07-22	2026-07-22	2026-07-22	high	system browser	raw/configs/hermes-config-sanitized.txt

Headless Server

Purpose

Headless X11 environment backing Hermes's browser automation and any GUI tooling.

Location

• Host: this container (ct460, hermes), no separate VM/LXC — headless stack runs directly alongside the agent.
• Display: Xvfb :99, resolution 1600x1200x24, started with -ac -nolisten tcp

Current configuration (verified via ps aux, 2026-07-22)

Process	Detail
Xvfb	:99 -screen 0 1600x1200x24 -ac -nolisten tcp
fluxbox	window manager on :99
x11vnc	-display :99 -forever -shared -rfbport 5901 -rfbportv6 5901 -noxdamage -quiet -nopw — no VNC password set
websockify ×2	127.0.0.1:6080 → 127.0.0.1:5900 and 127.0.0.1:6081 → 127.0.0.1:5901, serving noVNC (/usr/share/novnc)

Two VNC/websockify pairs exist (5900/6080 and 5901/6081) — the second (:99→5901→6081) is the one confirmed above; the first (5900→6080) predates it and wasn't independently re-verified this pass — unresolved whether it's a second live display or a leftover process.

Connected systems

• systems/hermes-agent (browser backend uses this display — see systems/browser-backend / comparisons/camoufox-vs-chrome)
• infrastructure/hosts

Known issues

• x11vnc -nopw: VNC is unauthenticated. It's bound to all interfaces (0.0.0.0:5901 and [::]:5901), not just loopback — reachable from the LAN and, if any tunnel/firewall rule forwards it, potentially beyond. Worth restricting to loopback or adding -passwd/-rfbauth if this hasn't been a deliberate choice.

Relevant runbooks

• runbooks/restart-browser