Chas’s Remote Terminal Install

This documents the specific remote terminal setup on Chas Watkins’ laptop (Vivo Pro 15), completed 2026-02-12. This is a reference for troubleshooting and recovery — not a general guide (see the Developer Guide for that).

Machine Details

Cloudflare Configuration

Access Application

Access Policy

SSH Certificate Authority

Local File Locations

Cloudflared Tunnel Config

File: ~/.cloudflared/config.yml

tunnel: 3aba34f7-27ed-4ce5-8713-838f4f49d64c
credentials-file: /home/chas-watkins/.cloudflared/3aba34f7-27ed-4ce5-8713-838f4f49d64c.json

ingress:
  - hostname: ssh.ipnoelp.com
    service: ssh://localhost:22
  - service: http_status:404

Systemd Services

cloudflared-tunnel.service

Runs the Cloudflare tunnel as user chas-watkins. Auto-restarts on failure.

[Unit]
Description=Cloudflare Tunnel (laptop-ssh)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=chas-watkins
ExecStart=/usr/bin/cloudflared tunnel --config /home/chas-watkins/.cloudflared/config.yml run laptop-ssh
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

tmux-claude.service

Creates a tmux session named “claude” on boot. Multiple clients can attach simultaneously.

[Unit]
Description=tmux "claude" session (always-on)
After=network.target

[Service]
Type=forking
User=chas-watkins
ExecStart=/usr/bin/tmux new-session -d -s claude
ExecStop=/usr/bin/tmux kill-session -t claude
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

tmux Configuration

File: ~/.tmux.conf

set -g mouse on
set -g history-limit 50000
set -g default-terminal "screen-256color"
setw -g aggressive-resize on
set -g status-right '#[fg=green]#H #[fg=yellow]#S'

Key setting: aggressive-resize on allows multiple clients at different screen sizes without forcing the smallest size on everyone.

SSH Server Modifications

Added to /etc/ssh/sshd_config:

PubkeyAuthentication yes
TrustedUserCAKeys /etc/ssh/cf_ca.pub

# Cloudflare Access short-lived certificates
Match User chas-watkins
  AuthorizedPrincipalsFile /etc/ssh/cf_principals

Principals file (/etc/ssh/cf_principals):

chas@omelasai.com
chas@lifeonroatan.com

This enables passwordless SSH login when connecting through Cloudflare Access — Cloudflare issues a short-lived certificate signed by its CA, and the SSH server trusts that CA for the chas-watkins user.

How to Use

From the laptop

tmux attach -t claude

From phone (or any browser)

1. Open https://ssh.ipnoelp.com
2. If session expired (every 30 days): enter chas@omelasai.com, get OTP code from email, enter code
3. SSH login is automatic (short-lived certificate — no password needed)
4. Run: tmux attach -t claude

Both devices now share the same terminal session in real time.

Important: Never detach others

Always use tmux attach -t claude (no -d flag). The -d flag detaches other clients, which defeats the purpose of simultaneous multi-device access.

Service Management

# Check all services
systemctl status cloudflared-tunnel
systemctl status tmux-claude
systemctl status ssh

# Restart tunnel
sudo systemctl restart cloudflared-tunnel

# Restart tmux session
sudo systemctl restart tmux-claude

# View tunnel logs
journalctl -u cloudflared-tunnel -f

# List tmux sessions
tmux list-sessions

# List clients attached to the claude session
tmux list-clients -t claude

Cloudflare API Token

Two tokens exist for managing this setup:

Token 1: “Claude CLI” (original setup, tunnel management)

• Stored in: ~/.cloudflared/cert.pem (encoded in the Argo tunnel token)
• Permissions: Tunnel management, DNS

Token 2: “access-management” (Access API)

• Stored in: ~/.cloudflared/.env as CF_ACCESS_API_TOKEN
• Expires: 2026-04-01
• Permissions:

Used by Claude Code to manage Access Applications, policies, session duration, and short-lived certificates.

Recovery After Reboot

Everything auto-starts via systemd. After a reboot, allow ~30 seconds for the tunnel to reconnect to Cloudflare. Verify with:

systemctl is-active cloudflared-tunnel ssh tmux-claude

All three should report active.