From tunpilot
Guides deployment of TunPilot server on Linux via SSH script, CLI connection with health checks, updates, and initial setup detection.
npx claudepluginhub buywatermelon/tunpilot --plugin tunpilotThis skill uses the workspace's default tool permissions.
Guide the user from zero to a fully connected TunPilot setup.
Deploys production Hysteria2 proxy nodes on Linux servers via SSH: probes capabilities, tunes performance/security, configures TLS, registers in TunPilot.
Guides secure self-hosting of OpenClaw on Linux cloud servers using rootless Podman, SSH tunneling, Tailscale, or reverse proxies, with hardening, token auth, pairing, and sandboxing.
Deploys and manages 3X-UI on Ubuntu/Debian VPS with Docker Compose, nginx proxy, ACME certs, SSH tunneling, UFW hardening, and Xray VLESS over XHTTP on port 443. For fresh installs, repairs, client adds, or safe updates.
Share bugs, ideas, or general feedback.
Guide the user from zero to a fully connected TunPilot setup.
Ask the user what they need before jumping into deployment:
Ask the user for the target server — SSH destination (e.g. root@1.2.3.4 or an alias from ~/.ssh/config). Must be Linux with root access.
Test SSH connectivity — the agent cannot enter passwords interactively:
ssh <server> "echo ok"
If this fails, stop and tell the user to set up SSH key-based login first.
Check firewall — ensure port 3000 is open:
ssh <server> "command -v ufw && ufw allow 3000/tcp || command -v firewall-cmd && firewall-cmd --add-port=3000/tcp --permanent && firewall-cmd --reload || echo 'no firewall detected'"
Run the one-command deploy script:
ssh <server> "curl -fsSL https://raw.githubusercontent.com/Buywatermelon/tunpilot/main/scripts/deploy.sh | bash"
The script automatically:
/opt/tunpilot.envParse the script output. It should contain ✔ TunPilot deployed on http://<ip>:3000.
If it fails, diagnose:
ssh <server> "journalctl -u tunpilot --no-pager -n 50"
Common failures:
TUNPILOT_PORT in /opt/tunpilot/.env and restart.The same deploy script is idempotent. It git pulls and restarts, preserving .env and token:
ssh <server> "curl -fsSL https://raw.githubusercontent.com/Buywatermelon/tunpilot/main/scripts/deploy.sh | bash"
Before connecting, confirm the server responds from the client side (run locally, not via SSH):
curl --max-time 5 http://<ip>:3000/health
Expected: {"status":"ok"}. If this fails:
nc -zv <ip> 3000 to test TCP connectivity.journalctl -u tunpilot --no-pager -n 30.Set the server URL and auth token:
tunpilot config set server http://<ip>:3000
tunpilot config set token <auth-token>
The auth token is the AUTH_TOKEN value from /opt/tunpilot/.env on the server.
After configuring, verify the CLI can reach the server:
tunpilot health
This should return JSON with node health status.
The default deployment uses plain HTTP. The auth token is transmitted in cleartext. For production use, consider one of these mitigations:
Option A — SSH tunnel (simplest, no domain needed):
# On the local machine, forward local port 3000 to the server
ssh -N -L 3000:localhost:3000 <server>
Then configure CLI to http://localhost:3000 instead. The server can bind to 127.0.0.1 only (change TUNPILOT_HOST=127.0.0.1 in .env).
Option B — Reverse proxy with TLS (requires domain):
Use Caddy or nginx in front of TunPilot with a TLS certificate. Update TUNPILOT_BASE_URL to the HTTPS URL.
Option C — Firewall source IP restriction (quick hardening):
ssh <server> "ufw default deny incoming && ufw allow from <your-ip> to any port 3000 && ufw allow 22/tcp && ufw enable"
Restricts port 3000 to only your IP address.
After connecting, the CLI provides commands across 6 categories:
tunpilot node list, tunpilot node add, tunpilot node update, tunpilot node remove, tunpilot node synctunpilot user list, tunpilot user create, tunpilot user update, tunpilot user delete, tunpilot user reset-traffictunpilot sub list, tunpilot sub create, tunpilot sub deletetunpilot health, tunpilot traffictunpilot setting list, tunpilot setting setNext step: deploy proxy nodes using the deploying-hy2-nodes (Hysteria2) or deploying-xray-nodes (Trojan) skill.