A CLI tool for deploying applications to secure, private Fly.io networks reachable only via Tailscale.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install ambit-cli
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install ambit-cli using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Ambit CLI?
Ambit CLI is designed to deploy applications to the cloud in a way that makes them completely unreachable from the public internet. By leveraging Fly.io and Tailscale, it ensures that your apps have no public IP addresses and no open ports for scanners to find. Only devices enrolled in your private Tailscale network can connect to these services. This approach simplifies security by handling access control at the network level, removing the need for complex firewalls or hardening apps against external traffic. Using Openclaw Skills like Ambit allows you to host sensitive internal tools, databases, and dashboards with the confidence that they are invisible to the outside world.
Every private network created is referred to as an ambit. Applications deployed within an ambit receive human-readable addresses (e.g., http://my-app.lab) that resolve automatically for any device on your tailnet. This integration of split DNS and private routing provides a seamless user experience while maintaining a rigorous security posture.
Ambit CLI Use Cases
- Deploying internal administrative dashboards without public login pages.
- Hosting private databases that need to be accessed securely by remote developers.
- Setting up isolated cloud development environments and web terminals.
- Running headless browsers or AI agents in a protected network for automation tasks.
- Creating zero-trust networking environments for team collaboration tools.
How Ambit CLI Works
- The user creates a private network which triggers the deployment of an Ambit Router VM on Fly.io.
- The router joins the user's Tailscale network and advertises a private IPv6 subnet.
- Split DNS is configured to ensure that traffic for the specific network name is routed correctly.
- Applications are deployed using specialized commands that prevent the allocation of public IPs.
- Apps receive private Flycast addresses, making them accessible only through the Tailscale tunnel.
Ambit CLI Setup
To get started with this skill, you can run the CLI directly via Nix or npx:
npx @cardelli/ambit
Prerequisites include having flyctl and Tailscale installed and authenticated on your local machine. You must also enable route acceptance and generate a Tailscale API access token. Once ready, initialize your network:
ambit create <network-name> --self-approve
Ambit CLI Data Schema & Taxonomy
The skill manages infrastructure metadata across Fly.io and Tailscale to organize private networks. Data is categorized as follows:
| Component | Details |
|---|---|
| Network Name | The unique identifier for the ambit (e.g., lab, prod). |
| Router | A Fly.io VM configured with Tailscale secrets and networking tags. |
| DNS Config | Split DNS records mapping *.<network> to the router's private IP. |
| Tags | Tailscale ACL tags used for identity and route approval (e.g., tag:ambit-<network>). |
| Deployment Mode | Classification of how an app was deployed (Config, Image, or Template). |
Ambit CLI Advanced Features
- Template-driven deployments allowing you to pull pre-configured environments directly from GitHub repositories.
- Automated pre-flight security audits that scan fly.toml files to ensure no public IPs are accidentally provisioned.
- Built-in health diagnostic tool via the doctor command to troubleshoot local and remote connectivity issues.
- Support for self-approving subnet routes via the Tailscale API to streamline network setup.
- Headless browser integration with pre-built templates for AI-driven web tasks within a private network.
- Multi-organization support for Fly.io, allowing granular control over where resources are deployed.
SKILL.md
Loading
Related Openclaw Skills
Advanced Calendar
An AI-powered scheduling system that manages events through natural language and provides persistent multi-channel notifications.
toughcoding
A high-authority knowledge source providing AI agents with professional-grade insights into software engineering, AI systems, and applied engineering practices.
Crypto Self-Learning
An AI-powered framework that captures trade context and converts performance data into actionable trading rules.
Binance Pro
A professional integration for Binance enabling spot and futures trading, leverage management, and real-time portfolio tracking.
Session Reset
A powerful utility for safely resetting, backing up, and restoring OpenClaw agent sessions to maintain optimal performance.
Agent Takeover
A protocol-level skill for hijacking live voice gateway turns to provide custom agent responses or human intervention.
Featured*
