# SSH Access Map — Chief of Staff Reference

**Last updated:** 2026-05-10

## The fleet (Tailscale tailnet — single net, mixes RateRight + LFCS)

All machines on `mcloughlinmichael.r@` tailnet. Tailscale admin: https://login.tailscale.com/admin/settings/keys

| Host | Tailscale IP | SSH user | Key path | Status |
|---|---|---|---|---|
| VPS (me) | `100.116.48.82` | — | — | Running here |
| OpsMan (clawdbot) | `100.118.241.100` | `root` | `/root/.ssh/id_hermes_ed25519` | ✅ Reachable |
| Laptop (Rocky's Windows) | `laptop-cd8df7fs` / `100.108.207.15` | `mclou` | `/root/.ssh/id_hermes_ed25519` | ✅ Reachable |

## SSH commands

**To laptop (Rocky's Windows):**
```bash
ssh -i /root/.ssh/id_hermes_ed25519 mclou@laptop-cd8df7fs "<command>"
```

**To OpsMan:**
```bash
ssh -i /root/.ssh/id_hermes_ed25519 root@opsman-01 "<command>"
```

**To VPS (from outside):**
```bash
ssh root@134.199.153.159
```

## Common mistakes to NEVER repeat

1. **`tailscale ssh user@host`** — only works on Linux nodes with Tailscale SSH server. Does NOT work on Windows. Use plain SSH via hostname.
2. **`ssh user@100.108.207.15`** — fails if known_hosts has hostname entry only. Use hostname, not IP.
3. **`ssh root@laptop-cd8df7fs`** — wrong user. Windows OpenSSH uses `mclou` Administrator, NOT `root`.
4. **`ssh user@laptop-cd8df7fs`** — uses hostname only. Tailscale hostname resolves via DNS suffix `tail3ddf22.ts.net`.

## Windows SSH — CRITICAL PATTERN (learned 2026-05-10)

**PowerShell over SSH silently returns nothing.** Commands execute (exit 0) but produce no output. This causes `same_tool_failure_warning` loop — the tool "worked" but gave nothing, so retry fires 3 times.

**Working patterns — use these:**

```bash
# Read a file (PowerShell with proper escaping):
ssh mclou@laptop-cd8df7fs "powershell -Command \"Get-Content 'C:\\path\\to\\file' -Raw\""

# List directory:
ssh mclou@laptop-cd8df7fs "cmd /c dir C:\\Users\\mclou"

# Recursive file search (use findstr, not PowerShell):
ssh mclou@laptop-cd8df7fs "cmd /c findstr /s /i \"searchterm\" C:\\Users\\mclou\\path\\*"

# Check file existence with error handling:
ssh mclou@laptop-cd8df7fs "powershell -Command \"try { Get-Content 'C:\\path' -Raw } catch { Write-Error \\\`\$_.Exception.Message }\""

# Run a .ps1 script file:
ssh mclou@laptop-cd8df7fs "powershell -ExecutionPolicy Bypass -File C:\\path\\to\\script.ps1"
```

**Broken patterns — never use:**

```bash
# Bare Get-ChildItem — returns nothing silently
ssh mclou@laptop-cd8df7fs "powershell -Command \"Get-ChildItem 'C:\\Users\\mclou'\""

# Bare Get-Content -Raw — returns nothing silently
ssh mclou@laptop-cd8df7fs "powershell -Command \"Get-Content 'C:\\path\\file.md' -Raw\""
```

**Loop detection:** If `same_tool_failure_warning` fires and you're doing Windows SSH with PowerShell — switch to `cmd /c` or `findstr`. Don't keep retrying the same broken pattern.

**Path escaping in PowerShell on Windows:**
- Inside double quotes over SSH, backslashes do not need escaping for the local Windows command
- Single quotes inside `-Command "..."` often fail — use escaped double quotes `\"` or use `cmd /c`
- When in doubt, `cmd /c` is the most reliable wrapper for Windows SSH commands

## Tailscale auth key setup (for new nodes)

Generate auth key: https://login.tailscale.com/admin/settings/keys

On new node:
```bash
tailscale up --authkey=tskey-auth-k...
```

## Adding new machines

1. Install Tailscale on the new machine, log in to `mcloughlinmichael.r@`
2. The machine appears in `tailscale status` on VPS within seconds
3. Add SSH user + key path to this reference
4. Test with `ssh -i /root/.ssh/id_hermes_ed25519 <user>@<tailscale-hostname>`