feat(infra): SSH-over-Cloudflare-Tunnel setup for cloud environments - #20
Merged
Merged
Conversation
Anthropic-hosted cloud sessions only egress over HTTP/HTTPS through a security proxy, so direct SSH to the auction server is impossible. Add: - infra/ssh-tunnel/server-setup.sh: one-shot root script that installs cloudflared as a service, authorises a dedicated key, and enables key-only root login (optional password-auth disable). - infra/ssh-tunnel/cloud-env-setup.sh: environment setup script that installs cloudflared without writing any secret into the cache. - infra/ssh-tunnel/session-init.sh: builds ~/.ssh config from env vars (key, Access service token, pinned host key) each session. - .claude/settings.json: SessionStart hook running session-init.sh in cloud sessions only. - infra/ssh-tunnel/README.md: dashboard steps, allowlist, env vars. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RMUkAjWYUX1CFQAe76zgEJ
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
SomeRandmGuyy
marked this pull request as ready for review
September 6, 2026 17:27
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Anthropic-hosted cloud environments only allow outbound HTTP/HTTPS through a security proxy, so
ssh root@<server>cannot work directly from a cloud session. This adds a Cloudflare Tunnel based route that carries SSH over HTTPS/WebSocket, gated by a Cloudflare Access service token.Changes
infra/ssh-tunnel/server-setup.sh: one-shot root script for the server. Installscloudflaredas a service, appends a dedicated public key toauthorized_keys, enables key-only root login, optional password-auth disable.infra/ssh-tunnel/cloud-env-setup.sh: cloud environment setup script. Installscloudflaredonly, so no secret lands in the cached filesystem snapshot.infra/ssh-tunnel/session-init.sh: builds~/.sshconfig each session from environment variables (private key, Access service token, pinned host key) and adds anauction-serverhost alias..claude/settings.json: SessionStart hook that runssession-init.shonly in cloud sessions.infra/ssh-tunnel/README.md: dashboard steps, Custom allowlist entries, environment variables, troubleshooting.Testing
bash -non all scripts and JSON validation of the settings file.cloudflared access sshthrough the session proxy.🤖 Generated with Claude Code
https://claude.ai/code/session_01RMUkAjWYUX1CFQAe76zgEJ
Generated by Claude Code