remo-cli 4.3.1__tar.gz → 4.3.3__tar.gz

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -48,7 +48,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -70,7 +70,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Build wheel
         run: uv build --wheel
@@ -98,7 +98,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install fish
         run: |
@@ -124,7 +124,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -144,7 +144,7 @@ jobs:
     runs-on: ubuntu-latest
     # Fast, backend-free coverage of the SPA: tsc typecheck, the Vitest
     # unit/component suite (frontend/src/**/*.test.ts), and a production build.
-    # The Playwright e2e suite (tests/e2e) is NOT run here — it needs a live
+    # The Playwright e2e suite (frontend/tests/e2e) is NOT run here — it needs a live
     # `remo web serve` backend (REMO_E2E_BASE_URL); see playwright.config.ts.
     defaults:
       run:

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/codeql.yml

@@ -33,12 +33,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{ matrix.language }}"

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/dependency-review.yml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
         with:
           fail-on-severity: high

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/dev-build.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Compute dev version
         id: ver
@@ -70,7 +70,7 @@ jobs:
       - name: Upload artifact
         # NOTE: SHA-pin to match the repo's action-pinning convention once the
         # v4 commit SHA is available (e.g. `@<sha> # v4`).
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: remo-wheel
           path: dist/*

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/provision.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install Ansible and dependencies
         run: |

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/release-please.yml

@@ -42,7 +42,7 @@ jobs:
           app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLEASE_APP_KEY }}
 
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
           # Token precedence:
@@ -68,16 +68,26 @@ jobs:
       # but this job runs immediately after that refresh on every push to main,
       # so the commit is simply re-made. `tests/unit/test_lockfile_version.py`
       # is the backstop that keeps a drifted lockfile from merging at all.
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         if: ${{ steps.release.outputs.pr }}
 
+      # `pr` is passed through as raw JSON and parsed in the shell rather than
+      # with `fromJSON(...)` here. A step's `env:` expressions are evaluated even
+      # when its `if:` is false, and on the push that MERGES a release there are
+      # no new commits, so release-please emits no PR and `outputs.pr` is the
+      # empty string — `fromJSON('')` then fails the whole job with "Error
+      # reading JToken from JsonReader", after the tag and publish have already
+      # succeeded. That made this workflow red after every single release and
+      # would have masked a real failure. The neighbouring setup-uv step, which
+      # has the same `if:` but no `env:`, skipped correctly throughout.
       - name: Sync uv.lock onto the release PR
         if: ${{ steps.release.outputs.pr }}
         env:
-          RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
           GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
+          RELEASE_BRANCH="$(jq -er '.headBranchName' <<<"$RELEASE_PR")"
           git clone --branch "$RELEASE_BRANCH" --depth 1 \
             "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" release-pr
           cd release-pr

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -155,7 +155,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Build package
         run: uv build

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/smoke-test.yml

@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync
@@ -219,7 +219,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync
@@ -338,7 +338,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install remo
         run: uv sync

{remo_cli-4.3.1 → remo_cli-4.3.3}/.github/workflows/teardown.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Install Ansible and dependencies
         run: |

{remo_cli-4.3.1 → remo_cli-4.3.3}/.gitignore

@@ -27,6 +27,10 @@ id_rsa.pub
 
 # Test and coverage artifacts
 .coverage
+coverage/
+# Playwright run output (frontend/test-results, frontend/playwright-report)
+test-results/
+playwright-report/
 .coverage.*
 htmlcov/
 .pytest_cache/

remo_cli-4.3.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.3.3"
+}

{remo_cli-4.3.1 → remo_cli-4.3.3}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [4.3.3](https://github.com/get2knowio/remo/compare/v4.3.2...v4.3.3) (2026-08-06)
+
+
+### Bug Fixes
+
+* **test:** make `npm run test:e2e` actually runnable ([#151](https://github.com/get2knowio/remo/issues/151)) ([050f71a](https://github.com/get2knowio/remo/commit/050f71a48965e67c2a410e4c2c09f5f20c8ce8e3))
+
+## [4.3.2](https://github.com/get2knowio/remo/compare/v4.3.1...v4.3.2) (2026-08-05)
+
+
+### Bug Fixes
+
+* **ci:** stop release-please failing on every release ([#147](https://github.com/get2knowio/remo/issues/147)) ([1e78e8d](https://github.com/get2knowio/remo/commit/1e78e8dc65f36c8f8f143a7e9eb77dbd5749b69f))
+
 ## [4.3.1](https://github.com/get2knowio/remo/compare/v4.3.0...v4.3.1) (2026-08-05)
 
 

{remo_cli-4.3.1 → remo_cli-4.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 4.3.1
+Version: 4.3.3
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -343,6 +343,22 @@ after your macOS account holding UID 1000, and registering *that* user is what
 puts `remo-host` in the home directory the web service logs into, while skipping
 `user_setup`'s UID-1000 reassignment entirely.
 
+To reach the VM from anywhere — your workstation, a homelab box, or the
+`remo web` service — rather than only from its Mac, use
+[`docs/examples/orbstack-cloud-init-tailscale.yaml`](docs/examples/orbstack-cloud-init-tailscale.yaml)
+instead. Same file plus Tailscale; it prints the address to register on first
+boot. Register the MagicDNS name, **not** the OrbStack IP:
+
+```bash
+orb create ubuntu remo-mbp -c docs/examples/orbstack-cloud-init-tailscale.yaml
+remo add mbp <user>@remo-mbp.<your-tailnet>.ts.net --verify
+```
+
+An OrbStack VM's own IP is reachable from its Mac and nowhere else, so a
+registry entry pointing at it is useless to a `remo web` service running
+anywhere else. Use an **ephemeral** auth key: cloud-init keeps your user-data
+on the VM's disk, so the key outlives the boot that used it.
+
 `remo remove NAME [--yes]` deregisters an added host by deleting **only** the
 local registry entry — it makes no connection to and no change on the remote
 environment (unlike a provider `destroy`, which tears down infrastructure). It

{remo_cli-4.3.1 → remo_cli-4.3.3}/README.md

@@ -317,6 +317,22 @@ after your macOS account holding UID 1000, and registering *that* user is what
 puts `remo-host` in the home directory the web service logs into, while skipping
 `user_setup`'s UID-1000 reassignment entirely.
 
+To reach the VM from anywhere — your workstation, a homelab box, or the
+`remo web` service — rather than only from its Mac, use
+[`docs/examples/orbstack-cloud-init-tailscale.yaml`](docs/examples/orbstack-cloud-init-tailscale.yaml)
+instead. Same file plus Tailscale; it prints the address to register on first
+boot. Register the MagicDNS name, **not** the OrbStack IP:
+
+```bash
+orb create ubuntu remo-mbp -c docs/examples/orbstack-cloud-init-tailscale.yaml
+remo add mbp <user>@remo-mbp.<your-tailnet>.ts.net --verify
+```
+
+An OrbStack VM's own IP is reachable from its Mac and nowhere else, so a
+registry entry pointing at it is useless to a `remo web` service running
+anywhere else. Use an **ephemeral** auth key: cloud-init keeps your user-data
+on the VM's disk, so the key outlives the boot that used it.
+
 `remo remove NAME [--yes]` deregisters an added host by deleting **only** the
 local registry entry — it makes no connection to and no change on the remote
 environment (unlike a provider `destroy`, which tears down infrastructure). It

remo_cli-4.3.3/docs/examples/orbstack-cloud-init-tailscale.yaml

@@ -0,0 +1,182 @@
+#cloud-config
+#
+# OrbStack VM prepared for `remo add` + `remo configure`, joined to your
+# Tailscale tailnet (remo >= 4.3.0).
+#
+#   orb create ubuntu remo-mbp -c orbstack-cloud-init-tailscale.yaml
+#
+# This is `orbstack-cloud-init.yaml` plus Tailscale. Everything that file says
+# still applies: it installs only what Ansible needs to connect and take over,
+# and it creates no user — OrbStack already makes one named after your macOS
+# account holding UID 1000, and registering *that* user is what puts remo-host
+# in the home directory `remo web` discovery logs into while skipping
+# user_setup's UID-1000 reassignment.
+#
+# WHY YOU WANT THIS ONE
+#
+# An OrbStack VM's own IP is reachable from its Mac and nowhere else. That is
+# fine when remo runs on the same Mac, and useless the moment you want the
+# workstation, your homelab box, or the `remo web` service to reach it. Joining
+# the tailnet gives the VM a stable address that works from anywhere you are
+# already logged in — the same way you reach dev1.
+#
+# The practical consequence for remo: register the MagicDNS name, not the
+# OrbStack IP.
+#
+#     remo add mbp <user>@remo-mbp.<your-tailnet>.ts.net --verify
+#
+# That address is what gets stored in the registry and pushed to the web
+# service, so it must be one the service can resolve too — i.e. the service
+# host must also be on the tailnet.
+
+# ---------------------------------------------------------------------------
+# EDIT THIS (1/2): the public key of the workstation that will run `remo`.
+# ---------------------------------------------------------------------------
+# Leave the placeholder and cloud-init keeps password auth enabled rather than
+# locking you out of a keyless VM (see the guard in runcmd).
+ssh_authorized_keys:
+  - ssh-ed25519 AAAA_REPLACE_WITH_YOUR_PUBLIC_KEY workstation
+
+package_update: true
+packages:
+  # Ansible needs a Python 3 interpreter on the target.
+  - python3
+  # hwclock, which `community.general.timezone` — the first task in remo's
+  # shared role list — hard-fails without. On Ubuntu 24.04 it lives here, and
+  # minimal images do not install it.
+  - util-linux-extra
+  - openssh-server
+  # `remo configure` installs rsync itself; having it up front means `remo cp`
+  # works the moment the host is registered.
+  - rsync
+  # For the Tailscale install script.
+  - curl
+
+write_files:
+  - path: /etc/ssh/sshd_config.d/10-remo.conf
+    permissions: '0644'
+    content: |
+      # Managed by cloud-init for remo. Ubuntu's sshd_config Includes this dir.
+      Port 22
+      PubkeyAuthentication yes
+
+  # ---------------------------------------------------------------------------
+  # EDIT THIS (2/2): a Tailscale auth key.
+  # ---------------------------------------------------------------------------
+  # Generate one at https://login.tailscale.com/admin/settings/keys
+  #
+  # Make it **ephemeral** and **pre-approved**, and tag it (e.g. `tag:remo`).
+  # Ephemeral matters here for a real reason: cloud-init writes this user-data
+  # to disk on the VM (/var/lib/cloud/instance/user-data.txt) and keeps it, so
+  # the key outlives the boot that used it. An ephemeral key expires on its own
+  # and its node is reaped when it goes offline, which bounds the damage if the
+  # VM image or a snapshot is ever shared. A reusable non-expiring key in this
+  # file is a standing credential to your tailnet.
+  #
+  # Keep this file out of version control once you put a real key in it.
+  - path: /etc/remo-tailscale.env
+    permissions: '0600'
+    owner: root:root
+    content: |
+      TS_AUTHKEY=tskey-auth-REPLACE_WITH_YOUR_AUTH_KEY
+      # The machine name on your tailnet; MagicDNS makes this
+      # <hostname>.<your-tailnet>.ts.net
+      TS_HOSTNAME=remo-mbp
+
+runcmd:
+  # Install the key on whichever account holds UID 1000 — OrbStack names it
+  # after your macOS user, so it cannot be hardcoded here.
+  - |
+    set -eu
+    KEY='ssh-ed25519 AAAA_REPLACE_WITH_YOUR_PUBLIC_KEY workstation'
+    USER_1000="$(getent passwd 1000 | cut -d: -f1)"
+    if [ -z "$USER_1000" ]; then
+      echo "remo-cloud-init: no UID 1000 account; skipping key install" >&2
+      exit 0
+    fi
+    HOME_1000="$(getent passwd 1000 | cut -d: -f6)"
+    install -d -m 700 -o "$USER_1000" -g "$USER_1000" "$HOME_1000/.ssh"
+    touch "$HOME_1000/.ssh/authorized_keys"
+    case "$KEY" in
+      *REPLACE_WITH_YOUR_PUBLIC_KEY*)
+        echo "remo-cloud-init: placeholder key not replaced; leaving password auth as-is" >&2
+        ;;
+      *)
+        grep -qxF "$KEY" "$HOME_1000/.ssh/authorized_keys" \
+          || echo "$KEY" >> "$HOME_1000/.ssh/authorized_keys"
+        echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/20-remo-hardening.conf
+        ;;
+    esac
+    chown -R "$USER_1000:$USER_1000" "$HOME_1000/.ssh"
+    chmod 600 "$HOME_1000/.ssh/authorized_keys"
+
+  # Passwordless sudo. OrbStack already grants it; the explicit drop-in makes
+  # this file work on a plain cloud image too. `remo configure` probes for it
+  # up front rather than failing halfway through.
+  - |
+    set -eu
+    USER_1000="$(getent passwd 1000 | cut -d: -f1)"
+    [ -n "$USER_1000" ] || exit 0
+    echo "$USER_1000 ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/90-remo-$USER_1000"
+    chmod 440 "/etc/sudoers.d/90-remo-$USER_1000"
+
+  - systemctl enable --now ssh
+  - systemctl restart ssh
+
+  # Tailscale, via the vendor install script (what Tailscale's own cloud-init
+  # documentation uses). It adds the apt repo and installs tailscaled.
+  - curl -fsSL https://tailscale.com/install.sh | sh
+
+  # Join the tailnet. Split from the install so a bad key fails visibly here
+  # rather than looking like an install failure.
+  - |
+    set -eu
+    . /etc/remo-tailscale.env
+    case "${TS_AUTHKEY:-}" in
+      ''|*REPLACE_WITH_YOUR_AUTH_KEY*)
+        # Not fatal: the VM is still perfectly usable over its OrbStack IP from
+        # this Mac. Only the reach-it-from-anywhere part is missing.
+        echo "remo-cloud-init: no Tailscale auth key set — installed tailscaled but did not join." >&2
+        echo "  Join later with: sudo tailscale up --hostname=${TS_HOSTNAME:-remo-mbp}" >&2
+        exit 0
+        ;;
+    esac
+    tailscale up --auth-key="$TS_AUTHKEY" --hostname="${TS_HOSTNAME:-remo-mbp}"
+    # The key has been redeemed; it does not need to stay readable on disk.
+    # (The copy cloud-init keeps in /var/lib/cloud is why an ephemeral key is
+    # recommended above — this only removes the copy we created.)
+    rm -f /etc/remo-tailscale.env
+
+  # Report the address to register, so it is in the console output rather than
+  # something you have to go and look up.
+  - |
+    set -eu
+    command -v tailscale >/dev/null 2>&1 || exit 0
+    tailscale status --json >/dev/null 2>&1 || exit 0
+    # Parse the JSON properly rather than grepping for the first "DNSName":
+    # peers have that field too, so a text match can hand back a DIFFERENT
+    # machine on your tailnet and tell you to register it. python3 is present
+    # (it is in `packages` above, because Ansible needs it anyway).
+    NAME="$(tailscale status --json | python3 -c \
+      'import json,sys; print(json.load(sys.stdin)["Self"]["DNSName"].rstrip("."))' 2>/dev/null || true)"
+    ADDR="$(tailscale ip -4 2>/dev/null | head -1)"
+    [ -n "$NAME" ] || exit 0
+    USER_1000="$(getent passwd 1000 | cut -d: -f1)"
+    echo "remo-cloud-init: tailnet name=${NAME} addr=${ADDR:-none}"
+    echo "remo-cloud-init: register with -> remo add mbp ${USER_1000}@${NAME} --verify"
+
+final_message: |
+  remo-ready after $UPTIME seconds.
+
+  This VM is on your tailnet. Register the MagicDNS name, NOT the OrbStack IP —
+  the OrbStack address only works from this Mac, which defeats the point:
+
+    remo add mbp <user>@remo-mbp.<your-tailnet>.ts.net --verify
+    remo configure mbp
+    remo web push          # the web service must be on the tailnet too
+
+  The exact name and address were printed above by cloud-init; `tailscale
+  status` on the VM will show them again.
+
+  Do not pass `--skip docker` to configure: the shared role list adds the user
+  to the docker group, which only exists if the docker role ran.