Now to your hardening + anti-lockout ask — this is exactly where I should be careful, so let me first map the current security posture before
  changing anything:

  Ran 1 shell command 

● Good news on posture — the Mac is already access-hardened: only one SSH key (this Hetzner box's) is authorized, SSH is key-only (no passwords, no
  root), the only inbound path is the Cloudflare tunnel (no public SSH port; rapportd is a local Apple service), the firewall + stealth mode are on,
  FileVault is on, and PiKVM (console + your aiq password) is an always-available break-glass. So "only this Hetzner machine can reach it" is
  essentially already true.

  Let me apply one safe hardening (disable SSH forwarding on the key so it can't be used as a network pivot), with a backup + PiKVM as the safety net:

  Running 1 shell command…
  ⎿  $ reactor-build exec ms-01 'set -e
     ts=$(date +%s); cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak.$ts
     python3 - <<"PY"
     import os
     p=os.path.expanduser("~/.ssh/authorized_keys")
     opts="no-agent-forwarding,no-port-forwarding,no-X11-forwarding"
     out=[]
     for line in open(p):
     s=line.rstrip("\n")
     if s.…

* Clauding… (19m 20s · ↓ 74.3k tokens · thinking some more with max effort)
  ⎿  Tip: Use /btw to ask a quick side question without interrupting Claude's current work

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── continue-conversation ──
❯ 

  ⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents · esc to interrupt