dotfiles/.config/claude-rc/README.md

Always-on Remote Control

Reference copy of a machine setup: Claude Code Remote Control running as its own system user claude-rc, so my projects' read-only MCP servers (now: negsplit, ens-forecast) can be used from the Claude app on the phone. One user and one session (data) for all projects. The user holds only read-only database logins; Bash runs sandboxed without network and can't read them (only the MCP servers, which run outside the sandbox, do). Nothing secret in this folder: the ntfy topic lives only in /etc/claude-rc-notify.env.

Needs claude-code, bubblewrap, socat and each project's MCP server installed. Per project:

• negsplit: the installed negsplit (with python-mcp) and the garmin_ro grants from its sql/garmin_ro_grants.sql. A per-user query limit is a useful safety net (the session can lift it):

  mariadb -u root -p -e "ALTER USER 'garmin_ro'@'localhost' WITH MAX_STATEMENT_TIME 30;"
  

• ens-forecast: the installed ens-forecast-mcp (with python-mcp and python-mysqlclient) and the weather_ro grant from its sql/weather_grants.sql; the same safety net:

  mariadb -u root -p -e "ALTER USER 'weather_ro'@'localhost' WITH MAX_STATEMENT_TIME 30;"
  

Setup

Run from this folder. User and folders:

doas useradd --system --create-home --home-dir /var/lib/claude-rc --shell /usr/bin/nologin claude-rc
doas chmod 700 /var/lib/claude-rc
doas install -d -o claude-rc -g claude-rc -m 700 /var/lib/claude-rc/.config /var/lib/claude-rc/.claude /var/lib/claude-rc/data /var/lib/claude-rc/data/.claude
doas install -o claude-rc -g claude-rc -m 644 mcp.json /var/lib/claude-rc/data/.mcp.json
doas install -o claude-rc -g claude-rc -m 644 project-settings.json /var/lib/claude-rc/data/.claude/settings.json
doas install -o claude-rc -g claude-rc -m 644 user-settings.json /var/lib/claude-rc/.claude/settings.json

strictAllowlist must stay in the user settings: in project settings it has no effect.

Each project's config holds only a [readonly] section. negsplit (garmin_ro):

doas install -d -o claude-rc -g claude-rc -m 700 /var/lib/claude-rc/.config/negsplit
doas install -o claude-rc -g claude-rc -m 600 config.toml /var/lib/claude-rc/.config/negsplit/config.toml

ens-forecast (weather_ro): only the [readonly] section of my own config, so the password never shows:

doas install -d -o claude-rc -g claude-rc -m 700 /var/lib/claude-rc/.config/ens-forecast
awk '/^\[/ { keep = ($0 == "[readonly]") } keep' ~/.config/ens-forecast/config.toml | doas install -o claude-rc -g claude-rc -m 600 /dev/stdin /var/lib/claude-rc/.config/ens-forecast/config.toml

Log in, trust the folder and enable Remote Control once, interactively:

doas -u claude-rc sh -c 'cd /var/lib/claude-rc/data && exec claude auth login'
doas -u claude-rc sh -c 'cd /var/lib/claude-rc/data && exec claude'
doas -u claude-rc sh -c 'cd /var/lib/claude-rc/data && exec claude remote-control --name data --spawn session'

ntfy topic for the failure alert (subscribe to it on ntfy.sh), then the units:

doas sh -c 'umask 077; printf "NTFY_TOPIC=claude-rc-%s\n" "$(openssl rand -hex 16)" > /etc/claude-rc-notify.env'
doas install -m 644 claude-rc.service claude-rc-notify.service claude-rc-recover.service claude-rc-recover.timer -t /etc/systemd/system/
doas systemctl daemon-reload
doas systemctl enable --now claude-rc.service claude-rc-recover.timer

The service restarts with a growing delay (30 s to 10 min); after about 50 minutes of failures it gives up and sends the alert. The timer restarts it every 3 hours if it gave up, so a long network outage doesn't stop it for good. After upgrading a project's MCP server, or changing mcp.json or the settings, restart claude-rc.service so phone sessions use the new version.

Adding a project

Add its server to mcp.json and mcp__<server> to the allow list in project-settings.json (plus a Read rule for its chart folder, if any), install its [readonly] config as above, reinstall the changed files and restart the service.

Dead login

doas systemctl stop claude-rc.service
doas -u claude-rc sh -c 'cd /var/lib/claude-rc/data && exec claude auth login'
doas systemctl reset-failed claude-rc.service
doas systemctl start claude-rc.service