The Problem

Developers using AI coding CLIs often face a choice between local resource contention and complex, manually configured cloud environments. Setting up an always-on, secure development box typically involves provisioning a server, configuring firewall rules, establishing a secure tunnel, and installing tooling—tasks that are fragmented and often require exposing services to the public internet.

What This Does

Pocketdev is a command-line tool that provisions an always-on Hetzner server, locks it to a private Tailscale network (eliminating the need for public SSH), and installs a chosen AI coding agent (Claude Code, Codex, Cursor, Gemini, Grok, or Aider). The tool abstracts the infrastructure complexity into an interactive workflow. It handles the Hetzner server lifecycle via internal/hetzner/hetzner.go, manages Tailscale networking through internal/tailscale/tailscale.go, and performs the initial bootstrap using cloud-init scripts defined in internal/cloudinit/cloudinit.go. Code sources are handled through the TUI in internal/tui/tui.go, which supports cloning GitHub repositories, rsyncing local folders, or starting with an empty box.

Execution begins at main.go:64 (main), which invokes Run (internal/tui/tui.go:38). Run acts as the central hub, reaching 97 functions and being called from 18 places. The user interaction is dominated by Render (called 17 times) and New (called 11 times) within the TUI. The TUI itself is oversized at 897 lines in internal/tui/tui.go, calling into 10 other modules; changes to this file ripple widely due to its breadth. Infrastructure provisioning is distributed: internal/provision/provision.go (32 functions) manages the Hetzner node and firewall, while internal/cloudinit/cloudinit.go (8 functions) handles the bootstrap script execution and agent key installation.

How To Use It

Setup: Build or install the binary from source. The repository requires Go 1.25+ and ssh-keygen on the local machine.

go install github.com/0xMassi/pocketdev@latest
# Or: git clone https://github.com/0xMassi/pocketdev && cd pocketdev && go build -o pocketdev .

Configuration: Before running the tool, ensure you have a Hetzner Cloud project API token with Read & Write permission and a Tailscale reusable auth key (generated via Tailscale Settings → Keys). These are prompted for interactively during the first run; they are not stored in a static configuration file by default.

Running it: Execute pocketdev from a terminal. The tool walks through a series of steps:

  1. Paste the Hetzner token (validated before proceeding).
  2. Select box Type, Class, and Architecture.
  3. Choose a region from a filtered table.
  4. Connect Tailscale using the auth key.
  5. Select AI agents to install (Claude Code, etc.).
  6. Pick a code source (GitHub repo, local folder, or fresh start).

Once the box is provisioned and booted, SSH in and run pocketdev setup to complete agent authentication and project cloning.

Real-World Use

A developer traveling can spin up a dedicated development environment in minutes. By running pocketdev, they provision a Hetzner box isolated via Tailscale. After pocketdev setup installs the AI agent and clones the repository, they SSH in from a phone or laptop. This allows coding from any device using the same AI tools as their local machine, without configuring VPNs or exposing ports to the internet.

Code Health & Issues

Static analysis identified 5 findings:

  • [HIGH] Pin third-party GitHub Actions to a commit SHA - .github/workflows. The workflow references goreleaser/goreleaser-action@v6; a tag can be moved, meaning the action running with secrets is whatever its owner last pushed.
  • [MEDIUM] Declare least-privilege permissions for GITHUB_TOKEN - .github/workflows/ci.yml. The workflow declares no permissions, causing the token to inherit repository defaults and potentially allowing steps to push commits or mint releases.
  • [MEDIUM] Enable Dependabot or Renovate - No update bot is configured for the repo ecosystems or GitHub Actions.
  • [MEDIUM] Gate pull requests on a dependency vulnerability scan - No dependency scan is currently run in CI.
  • [LOW] Set timeout-minutes on the workflow jobs - 2 workflows declare no job timeout, risking overlap behind a two-hourly schedule.

The Bottom Line

Pocketdev is a pragmatic tool for developers needing a secure, remote AI coding environment without public SSH exposure. The Go-based TUI is functional and guides the user through complex provisioning steps effectively. However, the repository requires immediate attention to CI hygiene; specifically, pinning action SHAs and adding dependency scanning gates are critical for maintaining a secure CI pipeline. It is well-suited for individual developers or small teams already invested in Hetzner and Tailscale infrastructure.