Run Claude Code on Your Own VPS with LFG

TL;DR

LFG is a free, MIT-licensed control plane for AI coding agents. It runs Claude Code, Codex, OpenCode and five others in tmux sessions on your own box, then streams them to a web app you can open from your phone. One command installs it on a fresh Ubuntu VPS. Reach it over Tailscale and never over the public internet, because the web UI ships with no login at all. If you want to skip the server entirely, the one-click LFG workspace has it running already.

---

What LFG actually does

A coding agent in your terminal stops being useful the moment you close the laptop. LFG fixes that by moving the session somewhere that stays awake.

It starts each agent inside a long-lived tmux session on a machine you control. It streams the transcript to a web UI you can install as an app. You answer permission prompts and steer the work from your phone.

The important part is where the code lives. Agents run in your repos, with your local CLIs and your existing logins. There is no remote sandbox to keep in sync.

What you need

• A VPS running Ubuntu or Debian, with more than 4 GB of RAM
• A Tailscale account, which is free for personal use
• At least one coding agent you already pay for or have access to

The installer provisions Bun, tmux and git for you, so you do not need to prepare those.

One requirement catches people out: the install script targets Debian and Ubuntu specifically. It checks for apt-get and systemd and stops with an error if either is missing. Alpine, Arch and the RHEL family are not supported by the scripted path.

Step 1: Create the server

The LFG repo includes a ready cloud-init file for Hetzner. Copy deploy/hetzner/cloud-init.yaml, paste in your SSH public key, then create the box:

hcloud server create \
  --name lfg-1 \
  --type cpx21 \
  --image ubuntu-24.04 \
  --location fsn1 \
  --user-data-from-file deploy/hetzner/cloud-init.yaml

You can do the same thing through the web console. Create an Ubuntu 24.04 server and paste the file into the Cloud config field.

DigitalOcean works the same way. Create an Ubuntu Droplet, then run the installer over SSH.

Do not add a firewall rule opening port 8766. Nothing needs to reach this box from the internet.

Step 2: Run the installer

SSH in as a normal user, not root, and run one command:

curl -fsSL https://raw.githubusercontent.com/BennyKok/omg.dev/main/scripts/setup.sh | bash

The script refuses to run as root on purpose. Agents get shell access, and shell access as root on a server is not a risk worth taking.

It then does the work in order. It installs base packages, installs Bun, downloads the latest LFG release and verifies its checksum, writes a .env file with permissions locked to your user, and registers LFG as a systemd user service.

It is safe to run repeatedly. To update later, SSH in and run lfg setup again.

Check that it came up:

systemctl --user status lfg --no-pager
journalctl --user -u lfg -f

Step 3: Set up private access with Tailscale

This is the step people skip, and it is the one that matters.

Pass a Tailscale auth key to the installer so the box joins your private network at install time:

curl -fsSL https://raw.githubusercontent.com/BennyKok/omg.dev/main/scripts/setup.sh \
  | TS_AUTHKEY=tskey-auth-xxxx bash

Use an ephemeral, pre-approved, single-use key. Passing it on the command line keeps it out of any file on disk.

There is a gap in the shipped Hetzner cloud-init worth knowing about. It joins your Tailscale network, but it does not turn on tailscale serve, so you get no HTTPS URL out of the box. Set the flag explicitly and re-run:

LFG_TAILSCALE_SERVE=1 lfg setup

Now the installer prints an HTTPS address on your Tailscale domain name. Only devices on your own network can open it.

Step 4: Connect a coding agent

A fresh install has no agent CLIs signed in. The installer detects them but does not install them, because those tools own their own authentication and config.

For Claude Code, install it and sign in once:

claude

Finish the browser OAuth flow and you are done. An existing subscription works fine. If you prefer an API key, put ANTHROPIC_API_KEY in the .env file at ~/lfg/.env instead.

Codex, OpenCode, Cursor, Grok, Hermes and GitHub Copilot all work the same way, with their own one-time login. Pi is bundled with LFG and needs no separate install. If you are still deciding which agent to run, our rundown of AI code editors covers the trade-offs.

Restart the service after any change:

systemctl --user restart lfg

Step 5: Open it from your phone

Visit the Tailscale HTTPS address on your phone and install it as an app. You now have every session on the box in one place. You can switch agents and models per session, resume old work, and answer permission prompts from anywhere on your network.

For a tighter loop between your laptop terminal and your projects, the omg MCP server for Claude Code is worth a look, and custom slash commands cut down the typing.

The security rules that actually matter

LFG is powerful on purpose, and the project is unusually direct about the blast radius. Three rules cover most of it.

The web UI has no login. None. No password, no token, no basic auth. The whole design assumes the port is only reachable on a private network. Anyone who can open it can start agents and read everything.

Never bind to a public interface. Keep LFG_HOST=127.0.0.1. The systemd unit the installer writes hard-sets this after reading your .env, so a stale config file cannot expose the UI by accident. That is a real safety property, and it is why the scripted VPS install is safer than a container deploy.

Do not use Tailscale Funnel. Use tailscale serve. Funnel publishes to the open internet, which defeats the entire arrangement.

Two smaller things worth knowing. Agents often run with permission prompts skipped so they do not block, and the memory limit the installer sets is a resource boundary, not a sandbox. Give the box a least-privilege GitHub token and dedicated SSH keys rather than your main ones.

A note on the Docker path

LFG ships a Dockerfile, and there are configs for Railway, Fly, Render, Koyeb and DigitalOcean App Platform. These are good for a quick demo.

Be aware that the container binds to 0.0.0.0 by design, since a platform has to route to it. That container has no repos, no tmux history and no signed-in agent CLIs unless you add them. If you deploy this way, put your own authentication in front of it.

For daily work, the plain VPS install is the better shape.

When to skip the server

Self-hosting is the right answer when you want agents working on the repos and signed-in CLIs already on your machine. That is the entire point of the project.

If you just want to see what this feels like, or you would rather not run a box at all, the hosted LFG workspace starts with LFG already running and its prerequisites installed. Workspaces sleep when idle and wake on the same URL. You sign your agents in inside that workspace and clone repos into it.

Either way, the software is the same, and it is MIT licensed. You can read all of it, fork it, and move between the two whenever you want.