Chrome on a virtual display in the tent, for the CLAW to drive over CDP (browser open, eval, text, shot) and for a person to sign in through noVNC, which ./viewer switches on for one sign-in, behind a fresh token per session, and off again. CDP has no TCP port: Chrome's debugging pipe behind a Unix socket only the tent user opens; the screen is on a Unix socket too. A tent service; install adds Chrome's libraries, Xvfb, x11vnc and noVNC.

A private, read-only household budget viewer with burn management - a recurring run-rate, a ledger of decided cuts, projected monthly spend and an actuals-plus-projection chart - and a starter importer for CSV and text-layer PDF statements. Serves 127.0.0.1 or a shared TentClaw's socket; installs without pip; ships a made-up sample household.

Private Gitea behind a TLS reverse proxy: a gitea.sh client (repos, credential-helper push, account picture from id/avatar.png, admin accounts and organizations) and a tested deploy recipe (rootless Gitea, nginx + certbot webroot, proxy-only firewall).

Use and host Vaultwarden (Bitwarden-compatible) password vaults. Use a vault: read credentials with the pinned bw 2025.4.0 CLI and vault-fetch.sh, with a local `.credentials` fallback. Host a vault for people: run the official Vaultwarden server for the owner, as a shared-tent CLAW service (digest-verified install without Docker, a socket bridge within the service limits) or on their dedicated VM behind Caddy.

Self-host Block's Buzz (Nostr chat+git+agent workspace) - LIVE-VERIFIED on XIDAX: compose deploy, preflight gate, closed-relay membership, NIP-42 join-test tool, connect a claw