Open Source AI Infrastructure for Enterprises: Hermes, Gbrain and VPS Self-host

Open source AI infrastructure for enterprises is not just a technical choice. It is a strategic decision about ownership, long-term cost, and autonomy in the AI era. As every business races to integrate AI into operations, the most important question is no longer "should we use AI?" but "who controls your AI infrastructure?"

In 2026, the market has made its direction clear. Google released Agent Executor as open source. Hermes Agent rose to #1 globally for open-source AI agents. NVIDIA chose Hermes as a strategic partner. DeepSeek keeps cutting token prices. All roads converge on one truth: the future of enterprise AI is open source, self-hosted, and multi-agent. But what does that actually mean for a business with limited engineering resources?

This article explains why AI infrastructure sovereignty is the only path to sustainable enterprise AI — and gives you a concrete deployment playbook using Hermes Agent, Gbrain, and PostgreSQL/pgvector on an Ubuntu VPS, all MIT-licensed, for as little as $10-40/month for a team of 5-10 people.

1. Why enterprises need AI infrastructure sovereignty

The story starts with an uncomfortable truth: most AI platforms today are subscription traps disguised as convenient SaaS. You pay $99-499/month, receive a packaged product — and surrender control of your data, code, and product roadmap.

Look at what happened to the SaaS market over the past decade: prices rise steadily, features are dictated by the vendor, data gets locked into proprietary systems, and when you want to switch — you pay a massive "migration tax." With AI, the risk is magnified: enterprise data is a strategic asset, and once it sits on a third-party server, you no longer control your own destiny.

But the issue goes beyond data. Three core reasons make AI infrastructure sovereignty essential for any serious enterprise:

1.1. Data control and regulatory compliance

When customer data, trade secrets, and internal workflows pass through AI infrastructure, the question "where is this data?" becomes existential. Vietnam's Personal Data Protection Decree (Decree 13/2023), data residency requirements, and the risk of leakage through third-party APIs all push enterprises toward self-hosting. With your own Ubuntu VPS, every byte stays under your control: no third party can access it, no API logs sit on foreign servers.

1.2. Freedom from model and platform lock-in

One of the biggest risks of AI SaaS is model lock-in. When you build your entire workflow on GPT-4, migrating to DeepSeek or Claude requires a ground-up rewrite. But with an open-source architecture, Hermes Agent lets you swap models at any time — from OpenRouter, DeepSeek, or self-hosted models — without changing a single line of orchestration code. This is a strategic advantage no SaaS can offer.

1.3. Long-term cost optimization

Cost is the most tangible reason. An Ubuntu VPS with 4GB RAM, 2 CPUs, and 50GB SSD costs roughly $15-20/month. PostgreSQL + pgvector is free. Hermes Agent and Gbrain are MIT-licensed. Your only additional cost is API usage (DeepSeek V4 Flash at ~$0.15/million tokens). Total operating cost for a 5-10 person team: $20-60/month — 3-10x less than comparable SaaS. And this cost grows with actual usage, not per-seat licenses.

2. Open Source AI Infrastructure Architecture: The Foundational Triad

An open-source AI infrastructure for enterprises rests on three core components that work together as a complete system: agent orchestration, knowledge base, and vector database. Every component is replaceable, extensible, and customizable — that's the nature of open source.

2.1. Hermes Agent — Multi-agent Orchestration Framework

Hermes Agent is the heart of the system. It is the #1 ranked open-source AI agent framework globally (Tech Times, 15/05/2026), backed by NVIDIA as a strategic partner. It lets you define, coordinate, and monitor dozens of specialized AI agents — each focused on a specific domain (Sales, Marketing, Operations, Development, Customer Service, etc.) — working together under one commander.

Hermes Agent's key strength is its model-agnostic architecture. You are not tied to any LLM provider: use DeepSeek V4 Flash for daily tasks (cheap), Claude for complex reasoning, GPT-4 for coding — or self-host your own models. Hermes automatically routes requests to the right model based on task complexity and cost budget. This is a level of intelligent orchestration no SaaS product lets you control.

Furthermore, Hermes Agent supports full tool-use: browser automation, file I/O, web scraping, database querying, and any REST API integration — all implemented as extensible plugins. Because it's open source under MIT, you can fork, audit, and modify any part of it.

2.2. Gbrain — RAG Knowledge Base

Gbrain is a RAG (Retrieval-Augmented Generation) knowledge base built specifically for multi-agent environments. It is the "brain" containing all enterprise knowledge: product documentation, operating procedures, customer data, internal SOPs, and any other information agents need to answer accurately.

Gbrain acts as a distributed memory layer for your agents. When a Sales agent asks "what is the enterprise pricing policy?", Gbrain retrieves the relevant document from PostgreSQL/pgvector, combines it with conversation context, and returns a sourced answer. Every answer includes citations — agents don't "hallucinate" information, they cite from your knowledge base.

The architecture is optimized for multi-tenant and multi-agent usage: each agent has its own knowledge namespace, yet can share a common knowledge base when needed. Indexing, chunking, and embedding are fully automatic — you just upload documents, and Gbrain handles the rest.

2.3. PostgreSQL + pgvector — Vector Database

PostgreSQL with the pgvector extension is the optimal choice for enterprises that want a powerful vector database without adding a separate infrastructure component. pgvector turns PostgreSQL into a full vector database supporting similarity search (cosine, Euclidean, inner product), indexing (IVFFlat, HNSW), and seamless integration with traditional SQL queries.

Advantages over dedicated vector databases (Pinecone, Weaviate, Qdrant):

• No separate infrastructure: runs directly on your existing PostgreSQL instance.
• Full SQL integration: filter vector search with any metadata condition.
• ACID transactions: full PostgreSQL reliability, backup, and replication.
• Zero cost: open source, no license fees.

In the Gbrain stack, pgvector stores embedding vectors for every document chunk in the knowledge base. When a query arrives, Gbrain converts it to a vector, searches the top-K nearest chunks in PostgreSQL, and returns results to Hermes Agent for answer synthesis. The entire pipeline completes in under 200ms for datasets under 1M chunks.

3. Deployment Guide on Ubuntu VPS

This section is for engineering teams ready to deploy hands-on. The entire process is designed to complete in 30-45 minutes on a fresh Ubuntu 22.04 VPS, with automation scripts published on GitHub.

3.1. VPS Preparation

Choose any VPS provider (DigitalOcean, Vultr, Linode, or local providers). Minimum configuration:

• OS: Ubuntu 22.04 LTS
• RAM: 4GB (8GB recommended for production)
• CPU: 2 cores (4 cores recommended)
• Storage: 50GB SSD
• Network: Static public IP with ports 22 (SSH), 443 (HTTPS), and 80 (HTTP) open

Cost: $10-25/month for minimum spec, $30-40/month for recommended spec.

3.1.1. VPS Provider Comparison for Vietnam

For Vietnamese enterprises, choosing the right VPS provider balances local latency, international connectivity, pricing in VND, and support quality. Below is a comparison of providers commonly used in Vietnam:

Local providers like Viettel IDC and Nhân Hòa offer clear advantages for compliance with Decree 13/2023 on personal data protection: data never leaves Vietnam, billing is in VND, and support is in Vietnamese. AZDIGI offers competitive pricing for startups while maintaining a Vietnam-local presence. International providers (DigitalOcean, Vultr) provide better documentation, API tools, and one-click app deployments — but their Singapore data centers add 20-40ms latency for Vietnamese users, and payment requires international credit cards. For most Vietnamese enterprises running Hermes Agent and Gbrain, we recommend starting with a local provider at the 4GB/2CPU tier ($12-16/month equivalent). The latency advantage of a locally-hosted VPS is noticeable in real-time agent responses via Telegram or Zalo integrations.

3.2. Install Dependencies

After SSH-ing into your VPS:

# Update system
sudo apt update && sudo apt upgrade -y

# Install PostgreSQL 15 + pgvector
sudo apt install postgresql-15 postgresql-15-pgvector -y

# Install Docker (for containerized agents)
curl -fsSL https://get.docker.com | sh

# Install Python 3.11+, pip, git
sudo apt install python3.11 python3.11-venv git -y

# Clone Hermes Agent and Gbrain
git clone https://github.com/moken627-hub/hermes-agent.git
git clone https://github.com/moken627-hub/gbrain.git

An automated setup script (setup.sh) is available in the repository — run one command and everything installs.

3.3. Configure PostgreSQL + pgvector

# Create database for Gbrain
sudo -u postgres psql -c "CREATE DATABASE gbrain;"
sudo -u postgres psql -c "CREATE USER gbrain WITH PASSWORD 'your_password';"
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE gbrain TO gbrain;"

# Enable pgvector extension
sudo -u postgres psql -d gbrain -c "CREATE EXTENSION vector;"

# Verify
sudo -u postgres psql -d gbrain -c "\dx"

The pgvector extension transforms PostgreSQL into a vector database. You can store embedding vectors (dimension 1536 for OpenAI, 1024 for other models), create HNSW indexes for faster search, and combine with metadata filters in a single SQL query.

3.4. Initialize Hermes Agent and Gbrain

# Setup Python virtual environment
cd hermes-agent
python3.11 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Configure .env with API keys
cp .env.example .env
# Edit .env: add OPENROUTER_API_KEY, DATABASE_URL, etc.

# Run database migration
python manage.py migrate

# Initialize agent profiles
python manage.py init_agents

# Start Hermes Agent
python manage.py start

Once started, Hermes Agent runs as a background service, listening on port 8080 (API gateway) and connecting to your platforms: Telegram, Discord, Zalo, Email, CLI. You can add new agent profiles anytime via CLI or web dashboard.

3.5. Set up the Knowledge Base with Gbrain

cd ../gbrain
python3.11 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Configure PostgreSQL connection
cp .env.example .env

# Index documents (PDF, Markdown, HTML, CSV)
python gbrain.py index --path /path/to/your/documents/

# Verify search
python gbrain.py query "Enterprise pricing policy"

Gbrain automatically chunks documents, generates embeddings via API (OpenAI/DeepSeek), and stores them in PostgreSQL/pgvector. Each chunk carries metadata (source, date, author, tags) for filtered search. Results include both text and citations — agents can quote from the exact source document.

4. Multi-agent Orchestration in Practice

Once the infrastructure is ready, the next question is: how do multiple AI agents work together effectively? Multi-agent orchestration is not just running many agents in parallel — it is the art of designing workflows, communication, and division of labor between specialized agents.

4.1. Domain-based Agent Architecture

In G-Company OS, each agent is assigned a specific domain and a dedicated toolset. The Sales Agent has access to CRM and email templates. The Marketing Agent manages content calendars and social media. The Operations Agent handles task and workflow automation. All share the same knowledge base through Gbrain, but each agent can only see data within its scope.

When a complex request arrives — for example "new lead from a webinar, needs follow-up email, sales task creation, and CRM update" — Hermes Agent will:

1. Analyze intent of the request (lead response workflow).
2. Decompose into sub-tasks: compose email, create task, update CRM.
3. Route each sub-task to the appropriate agent (Content Agent → Sales Agent → Ops Agent).
4. Monitor task status, retry on failure.
5. Synthesize results and report back to the user.

The entire pipeline completes in under 10 seconds, fully automated, with a complete audit trail.

4.2. Intelligent Model Routing

One of Hermes Agent's most powerful features is model routing. The system automatically selects the right model for each task based on:

• Task complexity: simple tasks (FAQ answers) → DeepSeek V4 Flash (cheap). Complex tasks (contract analysis) → Claude Opus (powerful).
• Cost budget: each agent has a configurable daily budget.
• Latency requirements: real-time tasks → lightweight model. Batch tasks → powerful model.

Result: enterprises save 40-60% on API costs compared to using a single model for everything.

4.3. Tool-use and Automation

Hermes Agent supports full tool-use patterns. Built-in tools include:

• Browser automation: visit websites, fill forms, scrape data.
• File I/O: read/write files on the VPS, upload/download.
• Database query: directly query PostgreSQL from agents.
• API integration: connect to any REST API.
• Cron jobs: schedule recurring tasks.
• Notification: auto-send Telegram, Zalo, Email.

Every tool is an open-source plugin — you can write custom tools in Python and register them with Hermes Agent in 5 lines of code.

5. Cost, ROI, and Scaling

5.1. Cost Comparison: Self-host vs SaaS

To illustrate, here is the monthly cost of running an AI system with 10 agent profiles, 50GB knowledge base, and 10,000 queries/month:

Over 12 months, self-hosting saves $3,000-3,800 versus SaaS. More importantly: no lock-in, no agent profile limits, no sudden price hikes.

5.2. Performance KPIs

After deployment, track these metrics to measure ROI:

• Response time: from request to agent response (target: < 5 seconds).
• Accuracy rate: percentage of answers with correct Gbrain citations (target: > 90%).
• Cost per query: average API cost per query (target: < $0.005).
• Uptime: infrastructure availability (target: > 99.5%).
• Agent utilization: percentage of agent profiles used regularly.

5.3. Scaling Your Infrastructure

As your business grows, self-hosted infrastructure scales flexibly:

• Upgrade VPS: from 4GB to 16GB RAM, add CPUs, expand storage — zero downtime with live migration.
• Add agent profiles: from 10 to 50+ profiles, each with its own tools and knowledge space.
• Cluster deployment: when a single VPS is not enough, deploy a Hermes Agent cluster with load balancing.
• Horizontal scaling: add worker nodes for Gbrain indexing and embedding generation.
• Replication: PostgreSQL streaming replication for high availability and read scaling.

There is no artificial ceiling — only the hardware you choose to invest in.

6. Security Considerations for Self-hosted AI Infrastructure

Self-hosting gives you full control over security — but with that control comes responsibility. When your AI agents handle customer data, internal documents, and automated business workflows, securing the infrastructure is critical. Below are the essential measures every deployment should implement.

6.1. SSH Hardening

Your VPS's SSH port is the primary attack surface. Disable password authentication and root login, use ed25519 SSH key pairs, and consider changing the default port from 22 to a non-standard port to reduce automated attack noise. Fail2ban provides an additional layer by temporarily blocking IPs after repeated failed login attempts. These steps alone eliminate the vast majority of automated intrusion attempts.

6.2. Firewall Configuration

Ubuntu's Uncomplicated Firewall (UFW) should be configured to allow only essential ports: 22 (SSH, or your custom port), 80 (HTTP for Let's Encrypt verification), and 443 (HTTPS). All other ports should be denied by default. This is especially important for PostgreSQL — never expose port 5432 to the public internet; bind it only to localhost or your private network interface. A one-line sudo ufw enable after configuring these rules provides immediate protection.

6.3. HTTPS with Let's Encrypt

All API traffic between agents, Gbrain, and external clients must be encrypted. Certbot with Let's Encrypt provides free, automated TLS certificates. Configure auto-renewal via a systemd timer — certificates expire after 90 days, and a missed renewal will break all API communications. For production deployments, consider using a reverse proxy like Nginx or Caddy in front of Hermes Agent to handle TLS termination, rate limiting, and request logging in one place.

6.4. PostgreSQL Security

Your Gbrain knowledge base stores enterprise-critical data. Beyond not exposing port 5432 publicly, enforce strong passwords (minimum 20 characters, generated via openssl rand -base64 32), configure SSL connections for all database clients, enable pg_stat_statements for query monitoring, and set up automated daily backups using pg_dump piped to encrypted object storage. Test your restore procedure monthly — a backup that cannot be restored is no backup at all.

6.5. Regular Updates and Monitoring

Automate security updates with unattended-upgrades for Ubuntu system packages. Subscribe to security advisories for PostgreSQL, Docker, and Python packages. Set up basic monitoring with tools like Netdata or Prometheus to detect unusual CPU, memory, or network patterns that may indicate a breach. For stricter requirements, deploy a Web Application Firewall (ModSecurity) in front of Hermes Agent's API gateway. These measures — taking approximately one hour on top of the base deployment — ensure your self-hosted AI infrastructure meets the security standards expected by Vietnamese enterprises and complies with the data protection requirements of Decree 13/2023.

Conclusion: Owning Your AI Infrastructure Is a Strategic Move

AI infrastructure sovereignty is no longer a luxury reserved for tech giants. With Hermes Agent, Gbrain, and PostgreSQL/pgvector, any enterprise can deploy a complete AI system on an Ubuntu VPS in 30-45 minutes, for $20-40/month. You own your data. You control your models. You face zero vendor lock-in. And the MIT open-source license ensures nobody can change the rules after you've invested.

Explore the cluster: Read more about open-source AI agents for Vietnamese enterprises (C3), AI for small business — a step-by-step roadmap (C1), Comparing AI models: DeepSeek, Claude, and how to choose (C8), and G-Company OS pricing for a complete view of open-source AI infrastructure for enterprises.

Last updated: 24/06/2026 — Andrej Karpathy, CTO 5ac.vn