From 21c6c27c9238c2940593d0dbf826aa664f6a4f3c Mon Sep 17 00:00:00 2001
From: Chris Wanstrath <chris@ozmm.org>
Date: Mon, 16 Mar 2026 16:35:19 -0700
Subject: [PATCH] Add SSH CLI access and update install docs

---
 README.md          | 12 ++++++++++++
 install/install.sh | 10 ++++++++++
 2 files changed, 22 insertions(+)

diff --git a/README.md b/README.md
index e3081c8..0903d27 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,18 @@ Once complete, visit `http://<hostname>.local` on your local network.
 - https://toes.local web UI for managing your projects.
 - `toes` CLI for managing your projects.
 
+## ssh cli
+
+You can manage your toes server from any machine on your network over SSH — no install required.
+
+```bash
+ssh cli@toes.local           # interactive shell with tab completion
+ssh cli@toes.local list      # run a single command
+ssh cli@toes.local logs fog  # stream logs for an app
+```
+
+The `cli` user's login shell is the `toes` binary itself. No password is needed. With no arguments, you get an interactive REPL. With arguments, it runs the command and exits.
+
 ## cli configuration
 
 by default, the CLI connects to `localhost:3000` in dev and `toes.local:80` in production.
diff --git a/install/install.sh b/install/install.sh
index 227d9eb..349382e 100755
--- a/install/install.sh
+++ b/install/install.sh
@@ -112,6 +112,15 @@ for app_dir in "$DEST"/apps/*/; do
   rm -rf "$APPS_DIR/$app/.git"
 done
 
+# ── CLI + SSH ────────────────────────────────────────────
+
+info "Installing CLI"
+quiet bun run cli:build
+sudo cp dist/toes /usr/local/bin/toes
+
+info "Setting up SSH access"
+quiet sudo bash "$DEST/scripts/setup-ssh.sh"
+
 # ── Systemd ──────────────────────────────────────────────
 
 info "Installing toes service"
@@ -131,6 +140,7 @@ echo "  ${b}${g}🐾 toes $VERSION is up!${r}"
 echo "  ${d}─────────────────────────────${r}"
 echo ""
 echo "  Dashboard: ${c}http://$(hostname).local${r}"
+echo "  SSH CLI:   ${c}ssh cli@$(hostname).local${r}"
 echo ""
 echo "  ${d}Grab the CLI:${r}"
 echo "  ${c}curl -fsSL http://$(hostname).local/install | bash${r}"