Your Laptop Is the Cockpit, Not the Agent Runtime

·https://github.com/backpine/remote-agent-workspace
repoinfrastructureagentsremote-workspacesdev-environmentsagent-loopsremote-runtimecloudflaresyncthingsshcaddy

control-plane/runtime split maps to always-on agent loops without making the laptop the single point of failure

remote-agent-workspace is a clean blueprint for a remote-first dev rig: Herdr drives an always-on Linux mini PC over SSH, Syncthing mirrors project files back to the Mac, and Cloudflare Tunnel plus Caddy turn dev servers into HTTPS URLs without opening router ports.

The clever bit is not any single tool. It makes the laptop a control surface and the box the runtime. Your editor stays local, but agents, tests, and dev servers survive closed lids, network changes, and battery death. That’s the part most remote dev setups manage to make weirdly complicated.

For joelclaw, this is useful as a plain-language pattern for agent loops: separate the human cockpit from the always-on worker, keep review surfaces reachable, and document the boring recovery steps. The sharp edges are also right in the docs: protect every hostname with Cloudflare Access, use SSH keys instead of passwords, run long-lived work under tmux or systemd, and treat Syncthing as sync, not backup.

One thing to watch: the guide’s .stignore example excludes .git, which keeps repo state from thrashing through sync, but it also means Git truth needs a clear owner. That’s not a dealbreaker. It’s the kind of boundary worth writing down before agents start making changes on two machines.

Key Ideas

  • Herdr remote mode keeps the IDE and operator flow on the Mac while commands, agents, builds, and dev servers run on the always-on Linux box.
  • Syncthing provides the file mirror, so edits from the remote agent appear locally without moving the whole editing experience into a browser IDE.
  • Cloudflare Tunnel gives inbound reachability with an outbound daemon, no static IP, and no open router ports.
  • Caddy gives each dev server a stable hostname mapped to a local port, so review surfaces are URLs instead of terminal archaeology.
  • The docs call out the unsexy but important security layer: Cloudflare Access, unattended-upgrades, SSH keys, and no committed tunnel credential JSON.
  • The setup makes a useful agent-workflow distinction: the human needs a fast cockpit, but the agent needs a boring always-on runtime that does not care whether the laptop is awake.

Links

← All discoveries