The Devbox Build, Part 2: Reachable From Anywhere, Visible to No One

After part 1, I could reach the box from my desk and nowhere else. I wanted to reach it from my laptop, my phone and my other desktop, on any network. I also didn't want to open a port on my router.

That took three tools, and each one covers a different way a remote session dies. Tailscale finds the box on any network. mosh holds the connection when the network changes or the laptop sleeps. tmux holds my shell on the server, so I lose nothing when the connection drops anyway.

Tailscale, Minus One Feature

I installed Tailscale with its script and signed in. Every device I own signs in with the same identity, which puts them all on one tailnet. I turned on MagicDNS so the box answers as devbox. I also turned off key expiry for it, so a server I don't touch doesn't fall off the network months later.

I also skipped the one feature that looks most useful. Tailscale can take over SSH for you, but that breaks mosh's startup.

So the box keeps its own OpenSSH from part 1, with keys only, and Tailscale is how I find it.

A Firewall That Only Trusts the Tailnet

With Tailscale in place, I locked the box down so it only answers on the Tailscale interface. One rule allows anything arriving over the tailnet, SSH and mosh included. The home network gets nothing.

Before enabling it, I had to decide on a fallback over the home network for when Tailscale is down. I didn't add one. If you want one, add it first, and keep a second session open while you test.

This firewall comes back in part 4, when a container needs to reach the box's own front door and gets dropped on the way.

mosh and tmux

mosh has to be installed on both ends. Once it is, I connect with one word. dev runs mosh to the box and attaches to a tmux session called main, or starts it if it doesn't exist. I can close the laptop, change networks, and open it again to the same screen.¹

The tmux plugins save sessions and restore them when the tmux server starts, so my windows come back even after the box reboots.

The host entry in my ssh config stays plain, with just the name and my user. mosh starts its server over ssh, and a RemoteCommand in the host entry gets in the way of that.

mosh also has no scrollback of its own, which is one more reason tmux runs underneath it.

In part 3, out in a few days, the box starts running things.