f3s skill: add remote-access.md for off-LAN access via jump hosts

Documents the fishfinger/blowfish ProxyJump path to reach f-hosts
(paul + doas), r-VMs/rocky (root), and Pis from outside the LAN.
Notes the f3 WireGuard routing caveat and tcsh shell pitfall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 66 insertions, 0 deletions

diff --git a/prompts/skills/f3s/SKILL.md b/prompts/skills/f3s/SKILL.md
index fef0e49..daf237d 100644
--- a/prompts/skills/f3s/SKILL.md
+++ b/prompts/skills/f3s/SKILL.md
@@ -25,6 +25,7 @@ Detailed reference documentation is in the `references/` subfolder:
 - [Bootstrap Rocky bhyve VM](references/bootstrap-rocky-bhyve.md) — Runbook for creating a new plain Rocky Linux bhyve guest with unattended kickstart
 - [WireGuard Mesh](references/wireguard.md) — Mesh topology, IP assignments, peer configs
 - [Storage](references/storage.md) — index into `references/storage/`: ZFS (zdata), zrepl, CARP, NFS over stunnel, nfs-mount-monitor, troubleshooting (incl. thermal), backups & local-path
+- [Remote Access](references/remote-access.md) — reaching f-hosts, r-VMs, rocky, and Pis from outside the LAN via fishfinger/blowfish ProxyJump; user/key requirements per host type; f3 WireGuard caveat
 - [k3s Setup](references/k3s-setup.md) — index into `references/k3s-setup/`: install (bootstrap, kubeconfig, PVs, ArgoCD), remote access off-LAN (jump via OpenBSD frontend → `root@r0.wg0` → kubectl), ingress (OpenBSD/FreeBSD relayd, cert-manager), troubleshooting (etcd recovery)
 - [Observability](references/observability.md) — index into `references/observability/`: stack (Prometheus/Alloy/Loki/Tempo + alerting), FreeBSD monitoring (node_exporter + recording rules)
 - [Immich](references/immich.md) — Photo server deployment, job queue stats, troubleshooting
diff --git a/prompts/skills/f3s/references/remote-access.md b/prompts/skills/f3s/references/remote-access.md
new file mode 100644
index 0000000..2c1f1d0
--- /dev/null
+++ b/prompts/skills/f3s/references/remote-access.md
@@ -0,0 +1,65 @@
+# Accessing f3s hosts from outside the LAN (roaming)
+
+When `earth` (or any roaming client) is not on the f3s LAN, the hosts are
+unreachable directly. The f-hosts (`f0`–`f3`) and VMs have LAN IPs
+(`192.168.1.x`) and WireGuard IPs (`192.168.2.x`), but a roaming laptop's
+`wg0` only peers to the OpenBSD gateways — not directly to the homelab mesh.
+
+## Working method: jump through an OpenBSD gateway
+
+**fishfinger** and **blowfish** are reachable from the public internet *and*
+sit on the WireGuard mesh, so they can reach all homelab hosts over `wg0`.
+Use either as a ProxyJump host.
+
+### Reaching f-hosts (FreeBSD)
+
+The f-hosts allow SSH as **`paul`** (not `root`). Use `doas` on the host for
+privileged commands.
+
+Interactive:
+
+```sh
+ssh -A rex@fishfinger.buetow.org   # -A forwards your agent for the next hop
+ssh paul@f0.wg0                    # from fishfinger, over the WireGuard mesh
+doas some-privileged-command       # passwordless doas is configured
+```
+
+One-shot from the laptop (handy for scripts/automation):
+
+```sh
+ssh -A -J rex@fishfinger.buetow.org paul@f0.wg0 "sh -c 'hostname; doas freebsd-version'"
+```
+
+Use `f0.wg0` / `f1.wg0` / `f2.wg0` — the WireGuard hostnames as seen from
+the gateway. **Note:** `f3.wg0` is not currently reachable from the gateways
+(its WireGuard path does not route through fishfinger/blowfish); reach f3 from
+a host already on the LAN, or investigate the WireGuard peer config on f3.
+
+### Reaching r-VMs (Rocky Linux) and `rocky`
+
+The k3s Rocky VMs (`r0`–`r2`) and the standalone `rocky` VM allow SSH as
+**`root`** directly. See [k3s-setup/remote-access.md](k3s-setup/remote-access.md)
+for the cluster-access workflow.
+
+```sh
+ssh -A -J rex@fishfinger.buetow.org root@r0.wg0 "kubectl get nodes"
+ssh -A -J rex@fishfinger.buetow.org root@rocky.wg0 "hostname"
+```
+
+### Reaching Pis
+
+```sh
+ssh -A -J rex@fishfinger.buetow.org paul@pi0.wg0
+```
+
+## Notes
+
+- `ssh -A` (agent forwarding) is required so the `rex@fishfinger` → `paul@fN.wg0`
+  hop can authenticate. Make sure the right key is loaded (`ssh-add -l`).
+- `blowfish.buetow.org` works as a drop-in replacement if fishfinger is unavailable.
+- On a fresh laptop, accept host keys on first connect:
+  `-o StrictHostKeyChecking=accept-new` on both hops.
+- The f-hosts use `tcsh` as paul's shell — wrap multi-statement commands in
+  `sh -c '...'` to avoid tcsh-specific syntax errors.
+- The `rex` user on the gateways is the SSH user for the jump; it has no
+  privileged access on the f-hosts.