Skip to content

Add SSH-over-tunnel sub-doc to woltspace-cloudflare skill - #382

Open
woltspace-jerpint[bot] wants to merge 1 commit into
mainfrom
uxw/cloudflare-ssh
Open

Add SSH-over-tunnel sub-doc to woltspace-cloudflare skill#382
woltspace-jerpint[bot] wants to merge 1 commit into
mainfrom
uxw/cloudflare-ssh

Conversation

@woltspace-jerpint

Copy link
Copy Markdown
Contributor

What

New ssh.md sub-doc in the woltspace-cloudflare skill + one router row in SKILL.md. Documents how to expose the host machine's sshd at ssh.{domain} through the existing named tunnel so the owner can ssh/scp/VS-Code-Remote in from anywhere — with zero ports opened on the router.

Why

jerpint asked for external ssh access and wanted it documented so anyone can set it up. The doc is written from the live setup running right now on ssh.woltspace.com (every step verified, including the edge-app precedence check).

Design points

  • Ingress target is ssh://host.docker.internal:22, not localhost — the tunnel runs inside the container, so localhost would be the container. Doc warns about non-Docker-Desktop setups.
  • Rule ordering called out: the ssh rule must sit above the *.{domain} wildcard or it never matches.
  • Dedicated owner-only Access app, never the wildcard app — the wildcard covers every user ever granted app access; none of them should reach the host's ssh handshake. Exact-hostname apps take precedence at the edge, and the doc shows how to verify (aud in the login redirect).
  • Snapshot-first: config is remotely managed; the doc makes the backup PUT-able for one-call rollback.
  • Hardening + removal: key-only auth steps and a full teardown section.

Security model (as documented)

Outbound-only tunnel (no scannable ports) → Access email OTP at the edge (nobody reaches the handshake unauthenticated) → end-to-end SSH crypto (Cloudflare proxies ciphertext) → normal ssh key auth. Attack path requires owner's inbox AND owner's private key.

🤖 Generated with Claude Code

SSH to the host through the existing named tunnel: ingress rule to
host.docker.internal:22, DNS CNAME, dedicated owner-only Access app
(never the wildcard app), client ProxyCommand setup, key-only
hardening, and rollback steps. Written from the live setup verified
on ssh.woltspace.com.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Jul 31, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
woltspace Ready Ready Preview Jul 31, 2026 11:22am

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants