Bug Description

HERMES_DASHBOARD_PUBLIC_URL does not appear to be respected by the dashboard self-hosted OIDC login flow in Docker on Hermes 0.16.0. The documentation says this variable should override dashboard.public_url for OAuth callback construction behind reverse proxies, but Hermes still generated an http:// callback URL until I set dashboard.public_url directly in config.yaml.

Steps to Reproduce

1. Run Hermes Agent 0.16.0 in Docker Compose with the dashboard enabled and self-hosted OIDC configured behind a reverse proxy.
2. Set HERMES_DASHBOARD_PUBLIC_URL=https://hermes.domain.com in the container environment, and configure the OIDC provider callback URL as https://hermes.domain.com/auth/callback.
3. Open the dashboard and click Sign in with Self-Hosted OIDC.
4. Observe that the request fails before reaching the provider login page, and Hermes reports a generated callback URL of http://hermes.domain.com/auth/callback.
5. Edit /opt/data/config.yaml and set dashboard.public_url: 'https://hermes.domain.com', restart Hermes, and retry login.
6. Observe that login works after setting the value in config.yaml.

I first suspected a reverse proxy header issue, but directly calling Hermes with Host: hermes.domain.com and X-Forwarded-Proto: https still produced the same http://hermes.domain.com/auth/callback redirect URI. That suggests the issue is inside Hermes’ callback URL generation rather than in the proxy layer.
As a workaround, setting dashboard.public_url: 'https://hermes.domain.com' directly in /opt/data/config.yaml fixed the OIDC login flow immediately. Based on the docs, this workaround should not be necessary when HERMES_DASHBOARD_PUBLIC_URL is already set.

Expected Behavior

Hermes should honor HERMES_DASHBOARD_PUBLIC_URL=https://hermes.domain.com and generate the OIDC callback as https://hermes.domain.com/auth/callback, because the docs state that this environment variable overrides dashboard.public_url for OAuth callback construction behind reverse proxies.

Actual Behavior

Hermes generated http://hermes.domain.com/auth/callback during /auth/login?provider=self-hosted, which caused the OIDC provider to reject the redirect URI before showing the login page. The issue disappeared only after manually setting dashboard.public_url in /opt/data/config.yaml.

Affected Component

Other

Messaging Platform (if gateway-related)

No response

Debug Report

Hermes `/api/status` showed that auth was enabled and the self-hosted provider was loaded.


HTTP/1.1 503 Service Unavailable
{"detail":"Provider unreachable: redirect_uri may only use http:// for localhost/127.0.0.1, got 'http://hermes.domain.com/auth/callback'"}

{"ts":"2026-06-09T09:42:25.469868+00:00","event":"login_failure","provider":"self-hosted","reason":"provider_unreachable","ip":"192.168.XXX.XXX"}

Operating System

Docker v5.1.4 on Ubuntu 24.04

Python Version

3.13.5

Hermes Version

v0.16.0 (2026.6.5)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR