feat(claude-workstation): off-site headless Claude Code host on nas-2
Always-on Debian VM (Synology VMM, off-site nas-2) running Claude Code for
reattachable tmux sessions plus an unattended, hardened, bounded notes-distill
timer. Scheduled repo/report jobs stay in-cluster (Woodpecker cron); this host
holds no cluster-write creds.
- ansible/roles/claude-workstation: two credential-isolated Unix users
(interactive vs unattended), Node 22 + Claude Code, per-user claude-bot creds
and OAuth token (never --bare), Syncthing notes sync, daily distill timer with
systemd hardening + wall-clock kill, staged deny-default nftables egress
allowlist (ships DISABLED) with a DNS-refreshed allow set.
- ansible/plays/install-claude-workstation.yml + .woodpecker pipeline +
inventory group, mirroring the netbird-proxy off-site host pattern.
- kubernetes/apps/claude-workstation: read-only `view` ServiceAccount + token
(no talosconfig, no age key; view excludes Secrets).
- RUNBOOK.md: manual VM creation (cloud-init), networking (mesh + scoped
site-to-site backup), SA kubeconfig assembly, vault keys, egress cutover,
rotation, and cattle DR.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
claude-botandClaude Opus 4.8
4c04069d26