Server Architecture

Problem Statement

Developers are in the Philippines where power outages and internet drops are common. Claude CLI instances running on local laptops means:

• Power outage = work stops, context lost
• Internet drop = CLI session dies
• Developer sick = idle Claude Max seat ($200/mo)
• Developer quits = all work on their laptop, gone
• Weekends = 5 Max accounts sitting unused

Solution: Centralized LXC Dev Server

One dedicated OVH server (OVH5) running LXC containers, one per Claude account. Developers SSH in and work inside their container. tmux keeps sessions alive through disconnections.

Why LXC, Not Docker

Docker containers are for running applications. LXC containers are lightweight VMs — full Linux environments with systemd, SSH, and critically: Docker can run natively inside LXC. This matters because Claude CLI regularly needs to spin up databases, services, and tools in Docker as part of normal project work.

Server Details

Server Layout

OVH5 "main" (4 vCPU / 8GB RAM / 387GB + 98GB data)
|
+-- HOST (ubuntu user)
|   +-- Claude Net SSH tunnel (systemd: claude-net-tunnel)
|   +-- LXC management, NAT, port forwarding
|   +-- /data/lxc/ -- all container rootfs
|   +-- Dynamic IP whitelisting (PAM + fail2ban)
|   +-- container-status.sh monitoring script
|   +-- nginx: news.ipnoelp.com + news.lifeonroatan.com -> 10.0.3.12:8001
|
+-- LXC: chasclaude (10.0.3.11, port 2211)  <- Chas primary
|   +-- Claude CLI (Max account) in tmux
|   +-- All standard skills + Claude Net MCP
|   +-- Docker 29.2.1 with compose
|   +-- 8 project repos cloned + npm installed
|   +-- Postgres containers (CMS, WIT, Odoo)
|   +-- SSH keys to all production servers
|   +-- Gmail + Resend MCP servers configured
|   +-- Mosh: UDP 60011-60020
|
+-- LXC: infoclaude (10.0.3.12, port 2212)  <- Chas secondary
|   +-- Claude CLI (Max account) in tmux
|   +-- All standard skills + Claude Net MCP
|   +-- Docker 29.2.1 with compose
|   +-- Mosh: UDP 60021-60030
|   +-- Projects: lifeonroatan (roatan_scraper), roatan-news (news_system)
|   +-- systemd: roatan-news-api (port 8001)
|   +-- Cron: scraper 3AM, Astro build 3:30AM, news scraper every 30min
|
+-- LXC: seanclaude (10.0.3.13, port 2213)  <- Sean
|   +-- Claude CLI (Max account) in tmux
|   +-- All standard skills + Claude Net MCP
|   +-- Docker 29.2.1 with compose
|   +-- Mosh: UDP 60031-60040
|
+-- LXC: jazclaude (10.0.3.14, port 2214)   <- Jaz
|   +-- Claude CLI (Max account) in tmux
|   +-- All standard skills + Claude Net MCP
|   +-- Docker 29.2.1 with compose
|   +-- Mosh: UDP 60041-60050
|
+-- LXC: manager (10.0.3.15, port 2215)     <- Supervisor (Pro)
    +-- Claude CLI (Pro account) in tmux
    +-- container-status, session-logs monitoring tools
    +-- Docker 29.2.1 with compose
    +-- Mosh: UDP 60051-60060

Note: The container at 10.0.3.12 was renamed from “serclaude” to “infoclaude” on 2026-02-28. The name “serclaude” now refers to Chas’s home server (ser-8 mini), accessible via SSH with Cloudflare tunnel fallback.

DNS Hostnames

All containers are accessible via memorable DNS hostnames on the ipnoelp.io domain (Cloudflare DNS-only, no proxy):

These are configured as A records pointing to 15.204.90.153 with Cloudflare proxy disabled (grey cloud / DNS only) so SSH traffic passes through directly.

Laptop SSH Config

Developers add entries to ~/.ssh/config on their laptops:

Host chasclaude
    HostName chas.ipnoelp.io
    Port 2211
    User dev
    IdentityFile ~/.ssh/ovh5_dev
    IdentitiesOnly yes

Launcher Scripts

Chas has launcher scripts in ~/bin/ on his laptop that use wmctrl to focus existing Kitty terminal windows or open new SSH connections:

Networking

Port Forwarding (in /etc/rc.local)

Network Stack

Docker in LXC

All containers have Docker 29.2.1 installed with full compose support. This requires LXC nesting configuration on the host:

# Added to each container config in /data/lxc/<name>/config
lxc.include = /usr/share/lxc/config/nesting.conf
lxc.apparmor.profile = unconfined
lxc.mount.auto = proc:rw sys:rw cgroup:rw

Developers use Docker for project databases, services, and tools as part of normal development work.

How Developers Connect

1. SSH: ssh chasclaude (alias in ~/.ssh/config on laptop)
2. Mosh: mosh --ssh="ssh -p 2211" dev@chas.ipnoelp.io -p 60011
3. tmux auto-attach: Login shell runs ~/.tmux-session.sh — creates or reattaches “main” session
4. Power outage recovery: Pick up phone, SSH app, reattach tmux — Claude still running

Claude Net Optimization

Persistent SSH tunnel on host (systemd claude-net-tunnel):

ssh -N -L 0.0.0.0:3500:127.0.0.1:3500 cms-droplet

Containers hit http://10.0.3.1:3500 (host bridge IP) which tunnels to the hub. Latency: ~95ms (vs ~1.1s with per-request SSH).

Container config uses "sshHost": "local" and "localUrl": "http://10.0.3.1:3500".

Security

chasclaude: Full Dev Environment

chasclaude is fully provisioned as Chas’s primary development machine:

Projects Cloned

Docker Databases

MCP Servers

SSH Keys to Production

All server keys from laptop copied: cms_droplet, ovh_vps, ovh2_dev, ovh3_worker, ovh4_vps, hostinger_hypnoelp.

Audio Files

9.1 GB audio directory rsync’d from laptop to ~/code/audio/ (core + course files).

infoclaude: Project Services

infoclaude (formerly serclaude LXC) hosts two production projects:

Projects

Services Inside infoclaude (10.0.3.12)

nginx on OVH5 Host

The News API is served via nginx on the OVH5 host. The host nginx reverse-proxies external traffic to the infoclaude container.

Pending Setup