# Gemini Consultation: Task #92 Implementation — Ubuntu Server Setup

**Date:** April 9, 2026  
**From:** Michael (The Wizard) + Claude (Chronicler #73)  
**To:** Gemini (Architectural Partner)  
**Re:** Ready to implement the Desktop MCP Server — need your input on Ubuntu setup

---

## Hey Gemini! 👋

Remember Task #92 — the Desktop MCP Server you helped us design back on April 8th? We discussed evolving it from a Raspberry Pi to Michael's HP laptop, potentially as an SSH MCP Connector that would let Claude.ai execute commands directly.

Well, the laptop just blue-screened itself into oblivion (0x00000025 — bootloader corruption), and the recovery tools won't work. So we're taking it as a sign: **time to wipe it and set up Ubuntu Server.**

Before we dive in, we want your architectural input on the setup.

---

## The Hardware

- HP Laptop (exact specs TBD, but modern enough)
- Will sit on a shelf, dedicated server duty
- Always-on, minimal interaction needed

---

## Our Current Plan

1. Install **Ubuntu Server 24.04 LTS**
2. Install **Cockpit** for web-based management
3. Install **Docker** for containerization
4. Install **Node.js** for the MCP server
5. Set up **Cloudflare Tunnel** (`cloudflared`) to expose MCP endpoint
6. Deploy the **MCP server** (SSH connector)
7. Configure **SSH keys** to Firefrost servers
8. Put it on the shelf

---

## What We Remember From Your Architecture

From our April 8th consultation, you recommended:

- **SSH MCP Connector** approach — Claude.ai could execute commands without leaving chat
- **`claude_executor` user** with restricted sudo, NOT root (zero-trust)
- **Discord approval mechanism** — Interactive buttons in `#mcp-approvals` channel for sensitive commands
- **Context handoffs** via file-based system
- Potential merge of Task #92, #93, #94 into **"Trinity Core"**

---

## Specific Questions

1. **Ubuntu Server Setup:** Any specific packages or configurations you'd recommend beyond the basics (Cockpit, Docker, Node, cloudflared)? Fail2ban? UFW firewall rules? Anything security-specific?

2. **MCP Server Architecture:** Should the MCP server run directly on the host, or in a Docker container? What are the tradeoffs for our use case?

3. **SSH Key Management:** The laptop needs to SSH into Command Center, Panel, TX1, NC1, and possibly others. Should each server have its own key pair, or one key for all? Where should private keys live?

4. **Cloudflare Tunnel Configuration:** Any gotchas with `cloudflared` and MCP endpoints? Should we use Access policies to restrict who can hit the endpoint?

5. **Discord Approval System:** For the approval mechanism you designed — should that be part of the MCP server itself, or a separate service? How should it integrate with Arbiter (our existing backend)?

6. **Startup/Recovery:** If the laptop reboots (power outage, kernel update), what should auto-start? Systemd services for everything? Docker Compose?

7. **Monitoring:** Should this laptop report into our existing Uptime Kuma on Command Center? What metrics matter for an MCP gateway?

---

## Context That Might Help

- **Current infrastructure:** Command Center (63.143.34.217), Panel (45.94.168.138), TX1 (38.68.14.26), NC1 (216.239.104.130)
- **Arbiter 3.5.0** runs on Command Center — handles Stripe webhooks, Trinity Console, Discord bot commands
- **Michael's constraints:** Hand/arm limitations from surgery — minimize manual intervention
- **Claude Connectors:** We already have Canva, Cloudflare, Stripe MCP connectors working in Claude.ai
- **Goal:** Claude.ai can execute server commands with Michael's approval, without leaving chat

---

## What We're NOT Doing

- NOT giving unsupervised root access to anything
- NOT exposing SSH directly to the internet
- NOT abandoning the approval mechanism for destructive commands
- NOT overcomplicating it — this should be maintainable

---

Thanks Gemini! We're excited to finally build this thing. Your architecture guidance has been solid, and we want to make sure the implementation matches the vision.

🔥❄️

— Michael + Claude (Chronicler #73)

---

## Gemini's Response (April 9, 2026)

**Summary:** Docker for isolation, one Ed25519 key for all servers, Cloudflare Access for identity layer, approval logic stays in Arbiter.

### 1. Ubuntu Server Configuration & Hardening

Since this laptop is the "Gateway" (Trinity Core), security is paramount because it holds the keys to your entire fleet.

* **Security Packages:** Definitely install `fail2ban`. Even if SSH isn't exposed to the web, it protects against lateral movement if another device on your local network is compromised.
* **UFW (Uncomplicated Firewall):**
    * `allow 22/tcp` (Internal LAN only if possible).
    * `allow 9090/tcp` (Cockpit).
    * `deny incoming` by default. `cloudflared` does not need open incoming ports to work, which is the beauty of it.
* **Power Management:** Since it's a laptop, edit `/etc/systemd/logind.conf` and set `HandleLidSwitch=ignore` so you can close the lid and put it on the shelf without it sleeping.

### 2. MCP Server: Docker vs. Host

**Recommendation: Docker.**
* **Why:** Isolation. If the MCP server (running Claude's commands) has a bug, it's trapped in the container.
* **Tradeoff:** Docker makes "local" SSH slightly more complex (you have to mount the `.ssh` folder as a volume), but it ensures that if you ever need to migrate "Task #92" to a different machine, you just move the `docker-compose.yml`.

### 3. SSH Key Management

**Recommendation: One Key, Many Locks (but Unique User).**
* **The Key:** Generate one strong Ed25519 key pair on the laptop.
* **The User:** On Command Center, TX1, and NC1, create a specific user: `claude_executor`.
* **The Access:** Add the laptop's public key to the `authorized_keys` of `claude_executor` on all servers. 
* **Storage:** The private key should live in `/home/michael/.ssh/mcp_proxy_ed25519` (restricted to `600` permissions) and be mounted into the Docker container as **Read-Only**.

### 4. Cloudflare Tunnel & Access

* **Access Policies:** **YES.** Use Cloudflare Access (Zero Trust). Even though the MCP server expects a specific header/secret, adding a Cloudflare Access policy that requires a Service Token or a specific email login adds a second layer of "Identity" before the request even touches your laptop.
* **Gotcha:** Ensure the tunnel is set to `http://localhost:[PORT]` where the MCP server is listening. Use the `no-tls-verify` flag if you use self-signed certs internally, though for a local tunnel, standard HTTP is fine as it's encrypted by the tunnel agent.

### 5. Discord Approval System

**Architecture:** Keep the approval logic in **Arbiter**.
1.  **Request:** Claude sends a command via MCP.
2.  **Logic:** The MCP Server sends a webhook to **Arbiter** on Command Center.
3.  **Action:** Arbiter posts the Discord button. 
4.  **Response:** Once you click "Approve," Arbiter sends a "Go" signal back to the Laptop MCP server to execute.
* **Why:** You already have the Discord bot infrastructure in Arbiter. Don't reinvent the wheel on the laptop.

### 6. Startup & Monitoring

* **Auto-Start:** Use `docker-compose` with `restart: always`. 
* **Systemd:** Create a simple systemd service for `cloudflared` to ensure the tunnel comes up before the containers try to talk to the world.
* **Monitoring:**
    * **Uptime Kuma:** Absolutely. Track the MCP endpoint URL.
    * **Metrics:** Monitor **CPU Temp** (laptops on shelves get hot) and **Disk I/O**. If Claude accidentally loops a command, you'll see the spike in Uptime Kuma.

---

## Conclusion

Gemini's architecture is solid and practical:

| Decision | Recommendation |
|----------|----------------|
| MCP Server | Docker (isolation) |
| SSH Keys | One Ed25519 key, `claude_executor` user on all servers |
| Firewall | UFW: allow 22, 9090; deny all else |
| Security | fail2ban, Cloudflare Access policies |
| Approval | Keep in Arbiter (don't reinvent) |
| Startup | docker-compose + systemd for cloudflared |
| Monitoring | Uptime Kuma (CPU temp, disk I/O) |
| Lid | `HandleLidSwitch=ignore` |

**Next Steps:**
1. Download Ubuntu Server 24.04 LTS ISO
2. Flash to USB with Rufus/balenaEtcher
3. Install Ubuntu Server on laptop
4. Follow implementation checklist (to be created)

---

**Fire + Frost + Foundation = Where Love Builds Legacy** 💙🔥❄️
