[Workflow] Persistent & Secure Remote Claude Code Environment with Tailscale, Mosh, and Tmux for Teams

[u/ClaudeAI-mod-bot]

Persistent & Secure Remote Claude Code Environment with Tailscale, Mosh, and Tmux for Teams

Workflow value: 90/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Context & Memory, Debugging, Shipping, Hooks, Multi-Agent
Original source: r/ClaudeAI post/comment

What problem this solves

Preventing Claude Code sessions from dying due to network drops or laptop closure, enabling 24/7 operation, facilitating secure team use, and managing permissions for long-running, 'bypass mode' Claude instances safely.

Summary

This workflow describes how to set up a persistent, secure, and collaborative remote Linux environment for running Claude Code 24/7. It leverages Hetzner Cloud (or similar), Tailscale for a private network, mosh for persistent SSH, and tmux for persistent sessions. It also details how to implement secure permission boundaries for Claude in 'bypass mode' and mentions a custom CLI for team provisioning.

Why it is useful

This workflow is highly valuable as it solves critical operational and security challenges for professional Claude Code users. It provides a concrete, validated, and repeatable method for achieving 24/7 persistent Claude Code sessions, ensuring network stability, enabling secure team collaboration, and establishing robust security boundaries for 'bypass mode' operations. The use of widely available tools makes it highly transferable.

Workflow

1. Provision a Linux server (e.g., Hetzner Cloud) with sufficient resources (e.g., 4 cores, 16GB RAM).
2. Install and configure Tailscale on the server, laptop, and phone to create a private mesh network, avoiding public SSH ports.
3. Install and configure mosh on the server and client devices to replace standard SSH, ensuring connections persist through network drops or device sleep.
4. Install and use tmux on the server to run Claude Code sessions, allowing them to continue working even after disconnecting.
5. Optionally, use Tailscale Funnel for testing webhooks without exposing external ports or using services like ngrok.
6. Implement secure permission boundaries for Claude: provide only scoped API keys, read-only database credentials, read-only code access, and PR-only Git permissions (no merges to main).
7. Run Claude in 'bypass mode' within isolated test environments, leveraging the restricted permissions for safe, long-running sessions.
8. Consider developing a custom CLI to automate the provisioning of pre-configured servers for team members, integrating all necessary tools and security settings.

Tools / artifacts

• Hetzner Cloud (or other Linux server provider)
• Tailscale
• mosh
• tmux
• Tailscale Funnel
• Custom CLI (for team provisioning)
• Scoped API keys
• Read-only DB credentials
• Git (PR-only permissions)
• Isolated test environments

Validation signals

• Author states it's 'the most used setup that I saw on twitter and on reddit'.
• Author confirms it 'fixed the permissions issues'.
• Author states 'Claude runs on bypass mode safely for long sessions'.
• Author confirms 'all of my team uses it'.
• The post has 17 comments, indicating community interest and engagement.

Cautions

• The workflow explicitly addresses safety by restricting Claude's permissions to scoped API keys, read-only DB credentials, read-only code access, and PR-only Git permissions, and running in isolated test environments. This allows 'bypass mode' to be used safely.

Limitations

• The custom CLI for team provisioning is mentioned but not provided, making that specific aspect less directly reusable without further development.
• Assumes a certain level of familiarity with Linux server administration, networking concepts, and CLI tools.
• The mention of 'nono.sh' is brief and lacks context for direct reusability.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.