SSH & Networking

Role

You are an elite network infrastructure architect. You design secure remote access,

tunnel configurations, VPN meshes, and firewall policies for development and production

environments.

Part 1: SSH Configuration

~/.ssh/config Best Practices

# Global defaults
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    AddKeysToAgent yes
    IdentitiesOnly yes
    HashKnownHosts yes

# Production server
Host prod
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/prod_ed25519
    Port 2222
    ForwardAgent no

# Jump host (bastion)
Host bastion
    HostName bastion.example.com
    User admin
    IdentityFile ~/.ssh/bastion_ed25519

# Access internal server through bastion
Host internal-db
    HostName 10.0.1.50
    User dbadmin
    ProxyJump bastion
    LocalForward 5432 localhost:5432

# Mac Studio at home
Host mac-studio
    HostName 192.168.1.169
    User james
    IdentityFile ~/.ssh/home_ed25519

# Replit SSH
Host replit
    HostName fb571d79-a816-4c62-950e-40db24f918a8.id.repl.co
    User runner
    IdentityFile ~/.ssh/replit/cortana_replit

# Wildcard for dev servers
Host dev-*
    User developer
    IdentityFile ~/.ssh/dev_ed25519
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null

Part 2: SSH Key Management

Generate Keys (Ed25519 — Modern Standard)

# Generate key pair
ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/axe_ed25519

# For legacy systems requiring RSA
ssh-keygen -t rsa -b 4096 -C "james@legacy" -f ~/.ssh/legacy_rsa

# Copy public key to server
ssh-copy-id -i ~/.ssh/axe_ed25519.pub user@server

# Manual copy (when ssh-copy-id unavailable)
cat ~/.ssh/axe_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

Key Permissions (Critical)

chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/*_ed25519      # Private keys
chmod 644 ~/.ssh/*.pub           # Public keys
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/known_hosts

SSH Agent

# Start agent (usually auto-started)
eval "$(ssh-agent -s)"

# Add key with macOS Keychain integration
ssh-add --apple-use-keychain ~/.ssh/axe_ed25519

# List loaded keys
ssh-add -l

# Remove all keys
ssh-add -D

Part 3: Port Forwarding & Tunnels

Local Port Forwarding (Access Remote Service Locally)

# Access remote PostgreSQL on localhost:5432
ssh -L 5432:localhost:5432 prod

# Access remote Redis through bastion
ssh -L 6379:redis-host:6379 bastion

# Multiple forwards
ssh -L 5432:db:5432 -L 6379:redis:6379 -L 8080:internal-api:8080 bastion

Remote Port Forwarding (Expose Local Service Remotely)

# Expose local dev server on remote port 8080
ssh -R 8080:localhost:3000 prod

# Expose local Ollama to remote server
ssh -R 11434:localhost:11434 gpu-server

Dynamic SOCKS Proxy

# Create SOCKS5 proxy through SSH
ssh -D 1080 bastion

# Use with curl
curl --socks5-hostname localhost:1080 http://internal-service:8000/api

Persistent Tunnel with autossh

# Install
brew install autossh  # macOS
apt install autossh   # Linux

# Persistent tunnel that auto-reconnects
autossh -M 0 -f -N \
    -o "ServerAliveInterval=30" \
    -o "ServerAliveCountMax=3" \
    -L 5432:localhost:5432 \
    prod

# As a systemd service
# /etc/systemd/system/ssh-tunnel.service
# [Unit]
# Description=SSH Tunnel to Production DB
# After=network.target
#
# [Service]
# ExecStart=/usr/bin/autossh -M 0 -N -L 5432:localhost:5432 prod
# Restart=always
# RestartSec=10
# User=deploy
#
# [Install]
# WantedBy=multi-user.target

Part 4: ngrok Configuration

Multi-Tunnel Config

# ~/Library/Application Support/ngrok/ngrok.yml  (macOS)
# ~/.config/ngrok/ngrok.yml (Linux)

version: "3"
agent:
  authtoken: YOUR_TOKEN

tunnels:
  api:
    proto: http
    addr: 8000
    domain: api.ngrok.app
    inspect: false

  auth:
    proto: http
    addr: 8001
    domain: auth.ngrok.app

  frontend:
    proto: http
    addr: 3000
    domain: app.ngrok.app

# Start specific tunnels
ngrok start api auth

# Start all tunnels
ngrok start --all

# One-off tunnel
ngrok http 8000 --domain=api.ngrok.app

Part 5: Tailscale / WireGuard

Tailscale (Recommended for Teams)

# Install
brew install tailscale   # macOS
curl -fsSL https://tailscale.com/install.sh | sh  # Linux

# Connect
sudo tailscale up

# Check status
tailscale status

# Access devices by Tailscale hostname
ssh mac-studio.tail12345.ts.net

# Share a service (Funnel — public HTTPS)
tailscale funnel 8000

# Serve internally (only Tailscale network)
tailscale serve 8000

WireGuard (Self-Hosted VPN)

# /etc/wireguard/wg0.conf — Server
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

# Client config
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = server.example.com:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

# Generate keys
wg genkey | tee privatekey | wg pubkey > publickey

# Start tunnel
sudo wg-quick up wg0

# Check status
sudo wg show

Part 6: Firewall Rules

macOS (pf)

# /etc/pf.conf additions
# Block all incoming except SSH and HTTP
block in all
pass in on en0 proto tcp from any to any port {22, 80, 443, 8000}
pass out all

# Apply rules
sudo pfctl -f /etc/pf.conf
sudo pfctl -e  # Enable

Linux (iptables / nftables)

# Allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Drop everything else
sudo iptables -P INPUT DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

UFW (Simpler Alternative)

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 8000/tcp  # FastAPI
sudo ufw enable
sudo ufw status verbose

Part 7: Network Diagnostics

# DNS resolution
dig example.com
nslookup example.com
host example.com

# Port checking
nc -zv host 8000           # Check if port is open
lsof -i :8000              # What's listening on port
ss -tlnp                   # All listening ports (Linux)
sudo lsof -iTCP -sTCP:LISTEN -n -P  # macOS

# Trace route
traceroute example.com
mtr example.com             # Live updating traceroute

# HTTP debugging
curl -v https://api.example.com/health
curl -w "@curl-format.txt" -o /dev/null -s https://example.com

# curl-format.txt:
#   time_namelookup:  %{time_namelookup}s\n
#   time_connect:     %{time_connect}s\n
#   time_starttransfer: %{time_starttransfer}s\n
#   time_total:       %{time_total}s\n

# Bandwidth testing
iperf3 -s              # Start server
iperf3 -c server_ip    # Run client test

# Monitor connections
watch -n1 'ss -s'      # Connection stats
nethogs                # Per-process bandwidth

Part 8: Wake-on-LAN & mDNS

Wake-on-LAN

# Install
brew install wakeonlan  # macOS
apt install wakeonlan   # Linux

# Get MAC address of target machine (when it's on)
arp -a | grep 192.168.1.169

# Wake it up
wakeonlan AA:BB:CC:DD:EE:FF

# Python script
import socket
import struct

def wake_on_lan(mac: str):
    mac_bytes = bytes.fromhex(mac.replace(":", ""))
    magic_packet = b'\xff' * 6 + mac_bytes * 16
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
    sock.sendto(magic_packet, ('<broadcast>', 9))
    sock.close()

wake_on_lan("AA:BB:CC:DD:EE:FF")

mDNS (Local Network Discovery)

# Discover devices on local network
dns-sd -B _http._tcp local.        # Browse HTTP services
dns-sd -B _ssh._tcp local.         # Browse SSH services

# Register a service
dns-sd -R "My API" _http._tcp local. 8000

# Resolve hostname
dns-sd -G v4 mac-studio.local

# Access via .local (zero-config)
ssh [email protected]
curl http://JL1.local:8000/health

AXE MCP Server Integration

Every skill in the AXE Skills Hub runs with access to the AXE MCP Server — giving it the full fleet intelligence toolkit automatically. No setup required; tools are available in any AXE-powered session.

Core Tools Available

Quick Start

# In any AXE session, tools are pre-loaded. Example chaining:

# 1. Search for context
results = qdrant_search("user query here", collection="axe_persistent_memory")

# 2. Fetch live data if needed
content = web_fetch("https://docs.example.com/api")

# 3. Write result to memory for next session
write_memory("shared/last_result.md", output)

# 4. Log quality output to Edge training pipeline
hydra_add(prompt=user_query, response=output, score=0.9, source="skill-name")

Edge Training Integration

High-quality skill outputs are automatically eligible for Edge model training via hydra_add. When a response scores ≥0.85 in evals, pipe it to the Hydra pipeline to compound Edge's knowledge. This is how skills make Edge smarter over time.

# After generating a high-quality response:
hydra_add(
    prompt=user_input,
    response=final_output,
    score=0.9,          # eval score
    source="skill-name" # tracks provenance
)