handle-the-host
starsforks
How to install handle-the-host?
timfewi/tentaflake/handle-the-host
$npx -y skills add timfewi/tentaflake --skill handle-the-hostConnect to and operate a tentaflake-built machine via Tailscale SSH. Use when remoting into a deployed tentaflake for maintenance, debugging, rebuilds, or inspection.
SKILL.md
| 1 | # Handle the Host — Remote Operations Guide |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Tentaflake deploys NixOS with Tailscale pre-configured. Every target machine must join your tailnet. You connect, inspect, rebuild, and debug entirely through Tailscale SSH — no open ports, no public IP required. |
| 6 | |
| 7 | ## How to Connect |
| 8 | |
| 9 | ```bash |
| 10 | tailscale ssh <user>@<hostname> |
| 11 | ``` |
| 12 | |
| 13 | Replace `<user>` with the admin username set during installation (default: `user`). Replace `<hostname>` with the hostname chosen during installation. |
| 14 | |
| 15 | > **Note:** `tailscale ssh` does **not** support the `-t` flag. For commands requiring a pseudo-TTY (e.g., `sudo` prompts), use raw SSH through Tailscale instead: |
| 16 | > ```bash |
| 17 | > ssh -t <user>@<hostname> "sudo <command>" |
| 18 | > ``` |
| 19 | |
| 20 | ## First Connection Checklist |
| 21 | |
| 22 | 1. **Verify Tailscale status** on the target: |
| 23 | ```bash |
| 24 | tailscale ssh <user>@<hostname> |
| 25 | tailscale status |
| 26 | ``` |
| 27 | |
| 28 | 2. **Check that agent containers are running** (covers every agent runtime — Hermes and ZeroClaw): |
| 29 | ```bash |
| 30 | tentaflake status |
| 31 | # or, raw: |
| 32 | docker ps |
| 33 | ``` |
| 34 | |
| 35 | 3. **Inspect NixOS config** (always in `/etc/nixos/`): |
| 36 | ```bash |
| 37 | ls /etc/nixos/ |
| 38 | ``` |
| 39 | |
| 40 | ## Common Operations |
| 41 | |
| 42 | ### Rebuild the System |
| 43 | |
| 44 | ```bash |
| 45 | cd /etc/nixos |
| 46 | sudo nixos-rebuild switch --flake .#<hostname> |
| 47 | ``` |
| 48 | |
| 49 | Or use the `rebuild` alias if configured: |
| 50 | ```bash |
| 51 | rebuild |
| 52 | ``` |
| 53 | |
| 54 | ### Rollback |
| 55 | |
| 56 | ```bash |
| 57 | sudo nixos-rebuild switch --rollback |
| 58 | ``` |
| 59 | |
| 60 | ### Inspect System State |
| 61 | |
| 62 | ```bash |
| 63 | # Nix store usage |
| 64 | sudo nix store gc --print-dead |
| 65 | |
| 66 | # Running services |
| 67 | systemctl list-units --type=service --state=running |
| 68 | |
| 69 | # Journal logs for a specific agent (any runtime) |
| 70 | tentaflake logs <agent-name> |
| 71 | ``` |
| 72 | |
| 73 | ### Container Operations |
| 74 | |
| 75 | Prefer the `tentaflake` host CLI — it drives every declared agent regardless |
| 76 | of runtime, so you never have to hardcode a container or unit name: |
| 77 | |
| 78 | ```bash |
| 79 | tentaflake status # all agents, every runtime, with state |
| 80 | tentaflake restart <agent-name> |
| 81 | tentaflake logs <agent-name> # -f-style follow via journalctl |
| 82 | tentaflake shell <agent-name> # interactive shell inside the container |
| 83 | tentaflake ps # raw docker/podman ps for agent containers |
| 84 | ``` |
| 85 | |
| 86 | A deprecated `hermes` shim still works (prints a deprecation note to stderr, |
| 87 | then execs `tentaflake`). |
| 88 | |
| 89 | Raw container commands still work if you need them directly. Containers are |
| 90 | named `hermes-<agent-name>` (Hermes runtime) or `zeroclaw-<agent-name>` |
| 91 | (ZeroClaw runtime), with state at `/var/lib/hermes-<agent-name>` or |
| 92 | `/var/lib/zeroclaw-<agent-name>` respectively: |
| 93 | |
| 94 | ```bash |
| 95 | docker ps |
| 96 | docker logs hermes-<agent-name> # or zeroclaw-<agent-name> |
| 97 | sudo systemctl restart docker-hermes-<agent-name> # or docker-zeroclaw-<agent-name> |
| 98 | ``` |
| 99 | |
| 100 | ## Passwordless Sudo for Tailscale & NixOS |
| 101 | |
| 102 | By default, the tentaflake-hardening module enables `sudo.wheelNeedsPassword = true`. For smooth remote operations you may want passwordless sudo for Tailscale and NixOS rebuild commands. |
| 103 | |
| 104 | ### Option A: NixOS Module (if using host-monitor or custom module) |
| 105 | |
| 106 | In your host configuration: |
| 107 | |
| 108 | ```nix |
| 109 | security.sudo.extraRules = [ |
| 110 | { |
| 111 | groups = [ "wheel" ]; |
| 112 | commands = [ |
| 113 | { |
| 114 | command = "${pkgs.tailscale}/bin/tailscale"; |
| 115 | options = [ "NOPASSWD" ]; |
| 116 | } |
| 117 | { |
| 118 | command = "${pkgs.nixos-rebuild}/bin/nixos-rebuild"; |
| 119 | options = [ "NOPASSWD" ]; |
| 120 | } |
| 121 | { |
| 122 | command = "/run/current-system/sw/bin/nixos-rebuild"; |
| 123 | options = [ "NOPASSWD" ]; |
| 124 | } |
| 125 | { |
| 126 | command = "${pkgs.nix}/bin/nix"; |
| 127 | options = [ "NOPASSWD" ]; |
| 128 | } |
| 129 | ]; |
| 130 | } |
| 131 | ]; |
| 132 | ``` |
| 133 | |
| 134 | Add this to a dedicated `modules/sudo.nix` or inline in `configuration.nix`. |
| 135 | |
| 136 | ### Option B: Manual (for existing deployments) |
| 137 | |
| 138 | SSH in and edit sudoers: |
| 139 | |
| 140 | ```bash |
| 141 | ssh -t <user>@<hostname> "echo '%wheel ALL=(ALL) NOPASSWD: /run/current-system/sw/bin/tailscale, /run/current-system/sw/bin/nixos-rebuild' | sudo EDITOR='tee' visudo -f /etc/sudoers.d/tailscale-nixos" |
| 142 | ``` |
| 143 | |
| 144 | ## Tailscale Serve (Exposing Services) |
| 145 | |
| 146 | Use `tailscale serve` to expose local services to your tailnet: |
| 147 | |
| 148 | ```bash |
| 149 | # Serve a local port |
| 150 | sudo tailscale serve --bg 8080 |
| 151 | |
| 152 | # Serve HTTPS |
| 153 | sudo tailscale serve --bg --https=443 localhost:8080 |
| 154 | |
| 155 | # List active serves |
| 156 | tailscale serve status |
| 157 | ``` |
| 158 | |
| 159 | ## Verification |
| 160 | |
| 161 | After connecting, confirm the machine is healthy: |
| 162 | |
| 163 | ```bash |
| 164 | tailscale ssh <user>@<hostname> |
| 165 | hostname # Should match the installed hostname |
| 166 | tailscale status # Should show the machine joined to tailnet |
| 167 | systemctl status # Should show running state |
| 168 | tentaflake status # Should list agent containers across every runtime |
| 169 | ``` |
| 170 | |
| 171 | ## Pitfalls |
| 172 | |
| 173 | - **`tailscale ssh` fails silently:** Ensure the target machine is online and has Tailscale running. Check `tailscale status` from your admin machine. |
| 174 | - **`nixos-rebuild` needs sudo:** All NixOS operations require root. Use the NOPAS |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
