Access desktop-managed SSH environments through T3 Connect

[tristendillon]

Before submitting

• I searched existing issues and discussions and did not find a duplicate.
• I am describing a concrete problem or use case, not just a vague idea.

Area

apps/desktop, apps/mobile, T3 Connect, remote environments

Problem or use case

I use T3 Code with Coder. Our dev environments run as Kubernetes containers on a LAN cluster, and T3 Code Desktop connects to them through Coder SSH.

So on my main machine I have something like:

T3 Code Desktop
├── SSH -> Coder workspace A
├── SSH -> Coder workspace B
└── SSH -> Coder workspace C

This works well on desktop.

The problem is mobile. I can connect my phone to the main machine with T3 Connect, but I can't access the SSH environments that the desktop already has configured.

The desktop already has the SSH config, credentials, Coder CLI, tunnels, and network access needed to reach those environments. I don't really want to reproduce all of that on my phone.

Proposed solution

Let a desktop connected through T3 Connect expose remote environments that it already manages.

For example:

Phone
  |
  | T3 Connect
  v
Main machine
├── Local environment
├── Coder workspace A
├── Coder workspace B
└── Coder workspace C

If I open workspace A from my phone, the desktop would establish or reuse its existing SSH connection and connect me to that T3 environment.

The mobile client wouldn't need SSH support itself.

Why this matters

Coder workspaces are disposable in our setup. Making every workspace separately register with T3 Connect adds another bit of lifecycle management to each container.

The desktop is the long-lived machine and already knows how to reach all of them.

This would also be useful anywhere someone has a main machine that can reach private SSH hosts that their phone can't access directly.

Smallest useful scope

When connected to a desktop through T3 Connect, show the SSH environments configured on that desktop and allow the user to open one through the existing desktop connection.

It doesn't need general SSH support on mobile.

Alternatives considered

I could set up T3 Connect separately inside every Coder workspace, but the workspaces are short-lived and I'd have to manage registration and cleanup for each one.

Mobile could also implement SSH directly, but then I'd need to move SSH credentials, Coder configuration, and network access onto the phone.

Risks or tradeoffs

The desktop would have to stay online because it is part of the connection path.

There would also need to be a way to control which desktop-managed environments are available remotely. I wouldn't expect every saved SSH host to automatically become accessible through T3 Connect.

Examples or references

My setup is:

Phone
  -> T3 Connect
     -> desktop
        -> Coder SSH
           -> Kubernetes dev workspace

The relevant existing behavior is described in:

• docs/user/remote-access.md
• docs/internals/remote.md

Contribution

• I would be open to helping test this against a Coder setup.

[tristendillon]

One extra thought on this after thinking about how it could work.

If a connected desktop can advertise environments it knows how to reach, this could eventually allow tree-like discovery between T3 clients too.

For example:

Phone
  -> Desktop B
     -> Desktop A
        -> SSH -> Coder workspace

Desktop B wouldn't need SSH access to the Coder workspace. It would just know that Desktop A has a route to that environment and could connect through A.

This seems related to #10940, which is about allowing multiple routes to the same environment. In this case, one of those routes could be "through another connected T3 client" instead of a direct URL, Tailscale, T3 Connect, etc.