Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Ambit deploys apps to Fly.io inside a private Tailscale network, making them unreachable from the public internet. Only devices enrolled in the user's Tailscale network can connect to deployed apps. Access control is enforced at the network level, so apps need no login pages or firewall rules.
Enforces access at the network layer instead of the application layer, so internal tools are private by default without any app-level hardening.
When to use it
- Deploying an internal dashboard without a public IP
- Running a headless browser accessible only to team devices
- Hosting a private dev shell reachable from any enrolled device
- Deploying a database or admin tool without configuring firewalls
- Sharing internal tools with teammates by enrolling their devices in the tailnet
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Deploy a headless Chrome browser to my private lab network
- 1Runs `ambit create lab --self-approve` to provision a Fly.io router joined to the Tailscale network
- 2Runs `ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/chromatic` to fetch and deploy the headless Chrome template
- 3Runs `ambit status --network lab` to confirm the router and app are online
- 4Confirms the app is accessible at my-browser.lab:9222 from any enrolled device
Headless Chrome is running at my-browser.lab:9222, reachable only from devices enrolled in the Tailscale network
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.