Overview

SSH access to Citra and Rowan (both physically inaccessible, off-site) is routed primarily through Thunderhead, a Samsung A50 running Termux with sshd, Tailscale, cloudflared, and Keycloak, physically accessible and holding a proven 99% uptime record. The observed 1% downtime has been WiFi-related, not hardware.

Mac keeps a direct fallback SSH path to both Citra and Rowan over Tailscale, covering the case where Thunderhead loses WiFi. iPhone and other devices route through Thunderhead only.

• Solid arrows represent primary SSH connection
• Dashed arrows represent fallback SSH connection

Why Thunderhead as hub

• Was running sshd, Tailscale, cloudflared, Keycloak, and PostgreSQL with a proven uptime track record
• Physically accessible, unlike Citra and Rowan, so it's a hub that can be walked up to and fixed
• Candidate for running k9s so all devices can share the same kubeconfig file
• Candidate target for the Postgres DB backup cron job, moving it off Rowan

Open items

• kubeconfig on Thunderhead should live in Termux's private app storage, not shared /sdcard, given it carries the cluster-admin cert/key