Setup Hermes + 9Router
+ NVIDIA NIM
di VPS dari Nol

# Format: ssh username@ip-vps
ssh root@IP_VPS_KAMU

# Kalau pakai SSH key file (.pem dari AWS misalnya):
ssh -i ~/.ssh/vps-key.pem root@IP_VPS_KAMU

# Pertama kali login → ketik 'yes' lalu tekan Enter

# Update daftar package
sudo apt update && sudo apt upgrade -y

# Install tools yang dibutuhkan
sudo apt install -y curl git build-essential ufw

# Izinkan port-port penting
ufw allow 22/tcp      # SSH — JANGAN LUPA INI atau kamu terkunci!
ufw allow 80/tcp      # HTTP
ufw allow 443/tcp     # HTTPS
ufw allow 20128/tcp   # 9Router dashboard

# Aktifkan firewall
ufw enable

# Cek status (semua port harus tampil ALLOW)
ufw status

# Tambah repository resmi Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

# Install Node.js
sudo apt install -y nodejs

# Cek versi Node.js — harus v22.x
node -v
v22.13.0   # output yang muncul

# Cek npm (package manager Node.js)
npm -v
10.9.0

# Install 9Router secara global via npm
sudo npm install -g 9router

# Verifikasi versi
9router --version
9router 0.4.13   # output yang muncul

# Jalankan sekali untuk inisialisasi config & database
9router

# Output yang muncul:
✓ Database initialized
✓ Listen: http://localhost:20128

# Tekan Ctrl+C untuk stop. Kita lanjut buat service.

# Buat file service 9Router
sudo tee /etc/systemd/system/9router.service > /dev/null <<'EOF'
[Unit]
Description=9Router AI Router
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/bin/9router
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# Reload systemd, aktifkan service, dan langsung start
sudo systemctl daemon-reload
sudo systemctl enable --now 9router

# Cek status — harus 'active (running)' dengan warna hijau
sudo systemctl status 9router

# Download binary cloudflared
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 \
  -o /usr/local/bin/cloudflared

# Beri izin eksekusi
chmod +x /usr/local/bin/cloudflared

# Verifikasi
cloudflared --version

# Buat systemd service untuk tunnel
sudo tee /etc/systemd/system/9router-tunnel.service > /dev/null <<'EOF'
[Unit]
Description=9Router Cloudflare Tunnel
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/local/bin/cloudflared tunnel --url http://localhost:20128 --no-autoupdate
Restart=always
RestartSec=10
StandardOutput=append:/tmp/9router-tunnel.log
StandardError=append:/tmp/9router-tunnel.log

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now 9router-tunnel

# Tunggu 5 detik, lalu lihat URL tunnel di log
sleep 5
tail -50 /tmp/9router-tunnel.log | grep trycloudflare.com

# Login ke Cloudflare (akan buka browser untuk auth)
cloudflared tunnel login

# Buat named tunnel
cloudflared tunnel create 9router-prod

# Arahkan subdomain ke tunnel (ganti yourdomain.com)
cloudflared tunnel route dns 9router-prod 9router.yourdomain.com

# Edit config tunnel (ganti UUID dengan yang muncul setelah 'create')
nano ~/.cloudflared/config.yml
# Isi dengan:
# tunnel: <UUID-tunnel>
# credentials-file: /root/.cloudflared/<UUID>.json
# ingress:
#   - hostname: 9router.yourdomain.com
#     service: http://localhost:20128
#   - service: http_status:404

# Jalankan tunnel permanen
cloudflared tunnel run 9router-prod

# Step 1: Dapatkan CLI token (otomatis dari machine ID VPS)
TOKEN=$(node -e '
const crypto = require("crypto");
const {machineIdSync} = require("node-machine-id");
const t = crypto.createHash("sha256")
  .update(machineIdSync() + "9r-cli-auth")
  .digest("hex").substring(0, 16);
console.log(t);
')
echo "Token: $TOKEN"

# Step 2: Validasi API key NVIDIA dulu (test tanpa efek samping)
curl -s -H "x-9r-cli-token: $TOKEN" \
  -H "Content-Type: application/json" \
  -X POST http://localhost:20128/api/provider-nodes/validate \
  -d '{
    "baseUrl":"https://integrate.api.nvidia.com/v1",
    "apiKey":"nvapi-XXX",
    "type":"openai-compatible",
    "modelId":"meta/llama-3.3-70b-instruct"
  }'
# Harus return: {"valid":true}

# Step 3: Buat provider node
NODE_ID=$(curl -s -H "x-9r-cli-token: $TOKEN" \
  -H "Content-Type: application/json" \
  -X POST http://localhost:20128/api/provider-nodes \
  -d '{
    "type":"openai-compatible",
    "apiType":"chat",
    "name":"NVIDIA NIM",
    "prefix":"nvidia",
    "baseUrl":"https://integrate.api.nvidia.com/v1"
  }' | python3 -c "import sys,json;print(json.load(sys.stdin)['node']['id'])")
echo "Node ID: $NODE_ID"

# Step 4: Hubungkan API key ke node
curl -s -H "x-9r-cli-token: $TOKEN" \
  -H "Content-Type: application/json" \
  -X POST http://localhost:20128/api/providers \
  -d "{\"provider\":\"$NODE_ID\",\"apiKey\":\"nvapi-XXX\",\"name\":\"NVIDIA NIM\"}"

# Ganti sk-xxx dengan API Key 9Router kamu (bukan NVIDIA key!)
NINER_KEY="sk-xxxxxxxxxxxx"

# Test kirim pesan ke NVIDIA Llama lewat 9Router
curl -X POST http://localhost:20128/v1/chat/completions \
  -H "Authorization: Bearer $NINER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nvidia/meta/llama-3.3-70b-instruct",
    "messages": [{"role":"user","content":"halo, siapa kamu?"}],
    "max_tokens": 50
  }'

# Install pip (package manager Python) — dibutuhkan Hermes
sudo apt install -y python3-pip python3-venv

# Buat direktori kerja Hermes
mkdir -p /root/.hermes
cd /root/.hermes

# Install Hermes Agent
npm install hermes-agent
# Alternatif jika via pip: pip install hermes-agent

# Buat file .env — GANTI nilai dalam kurung siku!
cat > /root/.hermes/.env <<'EOF'
# Token bot dari @BotFather
TELEGRAM_BOT_TOKEN=<token dari @BotFather>

# Telegram User ID kamu (angka, bukan username)
TELEGRAM_OWNER_ID=<user id kamu dari @userinfobot>

# API Key 9Router (ambil dari dashboard 9Router → Settings → API Keys)
OPENAI_API_KEY=<api key dari dashboard 9router>

# URL 9Router — JANGAN DIGANTI, ini sudah benar untuk setup lokal
OPENAI_BASE_URL=http://localhost:20128/v1

# Model default yang dipakai Hermes
DEFAULT_MODEL=free_smart_fallback
EOF

# Amankan file .env agar hanya root yang bisa baca
chmod 600 /root/.hermes/.env

cat > /root/.hermes/config.yaml <<'EOF'
providers:
  9router:
    name: 9Router
    base_url: http://localhost:20128/v1
    key_env: OPENAI_API_KEY
    default_model: free_smart_fallback
    models:
      free_smart_fallback: {}
      nvidia/deepseek-ai/deepseek-v4-pro: {}
      nvidia/meta/llama-3.3-70b-instruct: {}
fallback_providers:
  - provider: 9router
    model: free_smart_fallback
EOF

chmod 600 /root/.hermes/config.yaml

# Buat systemd service Hermes
sudo tee /etc/systemd/system/hermes.service > /dev/null <<'EOF'
[Unit]
Description=Hermes Agent (Telegram bot)
After=network.target 9router.service

[Service]
Type=simple
User=root
WorkingDirectory=/root/.hermes
EnvironmentFile=/root/.hermes/.env
ExecStart=/usr/bin/node /root/.hermes/node_modules/.bin/hermes-agent
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

# Reload, enable, dan start service Hermes
sudo systemctl daemon-reload
sudo systemctl enable --now hermes

# Lihat log realtime — Ctrl+C untuk berhenti
journalctl -u hermes -f

# Di chat Telegram dengan bot kamu:

/model
# Pilih: nvidia/meta/llama-3.3-70b-instruct
# Request langsung ke NVIDIA endpoint

# Test kirim pesan biasa:
halo, siapa kamu dan model apa yang kamu pakai?

# Cek status 3 service sekaligus
systemctl status 9router hermes 9router-tunnel

# Semua harus: active (running)