Run Conductor in the cloud — a guide

One Ironway project, one machine in the cloud running Conductor, set up from your own computer in about half an hour. Written for someone who can use GitHub and a terminal and has never run a server. The reference behind each step is a dedicated cloud host and deploy/opentofu/; this page is the walk through, in order, with what went wrong on the first real host and how each problem now shows up.

What you get, and why a separate machine

Conductor runs Claude sessions that write code, run tests and open pull requests, and it runs them with permission prompts turned off so nobody has to sit and click "allow". That is safe on a machine that holds one project's repository and nothing else, and it is not safe on the laptop that holds your documents. So the machine is a small cloud server, one per project, made and destroyed with one command, and it never sees your files.

on the machine	what it is	needed for the first test
Conductor	claims work from Ironway, runs a session per piece, opens the pull request	yes
TeamClaude	pools several Claude Max accounts and moves to the next when one runs low	optional, recommended
Tower	lets several sessions work on one PRD at once (a "swarm")	later
Roundhouse agent	runs CI for the project on the same machine	later

Before you start

An Ironway project with a connected GitHub repository and at least one approved PRD. Note its workspace and project slugs, the two words in its dashboard address /dashboard/t/<workspace>/projects/<project>. They are not the GitHub owner and repository name.
A Hetzner Cloud account and an API token: the Hetzner console, your project, Security → API tokens, Read & Write.
An SSH key on your Mac. Using 1Password: Settings → Developer → Use the SSH agent, and add the agent's socket to ~/.ssh/config:
```
Host *
  IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.group.com.1password/t/agent.sock"
```
Or export the private key to ~/.ssh/id_ed25519 and chmod 600 it. There is no password for the server, ever; the key is how you get in.
A Claude token: on your Mac, claude setup-token, and keep what it prints. It is a subscription token, not an API key.
OpenTofu: brew install opentofu.

1. Make the machine

git clone https://github.com/outdoorsea/switchyard-conductor.git
cd switchyard-conductor/deploy/opentofu/examples/hetzner
export HCLOUD_TOKEN=...
cp terraform.tfvars.example terraform.tfvars

Edit terraform.tfvars. For a Conductor-only first host:

location = "ash"
ssh_public_keys   = { me = "ssh-ed25519 AAAA... me@mac" }
existing_ssh_keys = []          # or the NAME of a key already in Hetzner, with ssh_public_keys = {}
projects = {
  my-project-1 = {
    project             = "my-workspace/my-project"   # Ironway slugs, not GitHub's
    tower               = false
    teamclaude          = true
    roundhouse_endpoint = ""
  }
}

Then tofu init && tofu apply, type yes, and tofu output hosts prints the line to sign in with. It takes about a minute. The 8-core machine is billed while it exists, roughly $60 a month at the time of writing; check Hetzner's current price.

ssh ops@<the address>
tail -f /var/log/conductor-bootstrap.log

It installs Go, the GitHub CLI, the agent CLIs and Conductor itself, which takes ten to fifteen minutes. Wait for bootstrap done; it ends by printing one command. Paste multi-line blocks one at a time in this guide: a command that opens a new shell or asks a question swallows the lines pasted after it.

If the log says bootstrap NOT run: could not clone, the Conductor repository is private and the machine had no GitHub login yet. The log prints the seven lines that fix it: install gh, sign it in as the conductor user, clone, and re-run cloud-init's own script.

3. Run the one setup command

sudo -iu conductor /home/conductor/GitHub/switchyard-conductor/scripts/systemd/setup.sh

It asks only for what it cannot find, and can be run again at any point:

The Claude token you made on your Mac. Paste it.
GitHub. It prints a code. Open https://github.com/login/device on your Mac and enter it; the server cannot open a browser itself.
Ironway. It prints a link; open it and approve the machine. It then registers the project and clones its repository.
The verify command, the check a build must pass before its pull request opens. It suggests one from the repository; for a large Go project the short form (go build ./... && go vet ./... && go test -short -timeout 30m ./...) keeps each build to minutes.
TeamClaude accounts, if installed. teamclaude login once per Claude Max account; use a private browser window for each extra account. Your Claude token from step 1 is still needed: the claude program checks its own login before the pool ever sees a request.
Doctor, which lists anything left, then start.

4. See it working

From your Mac, with Conductor built from this repository:

conductor tunnel ops@<the address>

It opens the machine's dashboard at http://127.0.0.1:18095, and TeamClaude's account pool is at http://127.0.0.1:13456/teamclaude/dashboard. Ctrl-C closes it. Without the conductor command, the same thing by hand:

ssh -N -L 18095:127.0.0.1:18095 -L 13456:127.0.0.1:13456 ops@<the address>

The machine uses 18095 and 13456 on purpose, so a Conductor and TeamClaude on your own Mac (8095 and 3456) keep running alongside.

The machine also shows up on Ironway under Account → Conductors, where it can be paused and resumed. The finish line for a first test is a pull request on the project's repository opened from a conductor/<install-id>/… branch.

5. When you are done

tofu destroy from the same folder removes the machine. Nothing on Ironway is lost; a new machine signs in and picks up where the old one stopped.

Troubleshooting

Every one of these happened on the first real host, and each now either cannot happen or says so plainly.

what you see	why	what to do
`tofu apply` asks for `var.hcloud_token`	an older version of the example	`export TF_VAR_hcloud_token="$HCLOUD_TOKEN"`, or update the checkout
`SSH key not unique`	the key is already in your Hetzner project	name it in `existing_ssh_keys` instead of `ssh_public_keys`
ssh asks for a password	your Mac did not offer the key	`ssh -i ~/.ssh/id_ed25519 …`, or turn on the 1Password agent (above)
`bootstrap NOT run: could not clone`	the repository is private	the commands the log prints
`setup.sh: Permission denied`	a `~` in the command meant your home, not conductor's	use the full `/home/conductor/…` path
`switchyard named no repository`	the project was given as GitHub `owner/repo`	the Ironway `workspace/project`; setup.sh now asks again
`Failed to connect to bus`	`sudo -iu` gives a shell without its systemd session	fixed in setup.sh; by hand, `export XDG_RUNTIME_DIR=/run/user/$(id -u)` first
Roundhouse: "no place to enter a code"	approving needs the Roundhouse admin token	leave `roundhouse_endpoint = ""` until you have it
the swarm is refused, "does not run inside Forge"	swarms need Tower	expected without Tower; single beads still build

What changed to make this work

All in this repository, on the branch that carries this page:

**deploy/opentofu/** — the Hetzner module, the example, and the templated cloud-init. Its inputs and outputs are what an AWS module implements next, so moving providers changes one line.
**scripts/systemd/bootstrap.sh** — optional steps for a one-project machine: a config for that project alone, Tower, the Roundhouse agent, TeamClaude, the 18095/13456 ports, and a hand-off to setup.sh.
**scripts/systemd/setup.sh** — new: every step that needs you, in one re-runnable command.
**conductor tunnel** — new command: the machine's dashboard in your browser.
cloud-init — a failed clone now says so instead of reporting success.

Run it in the cloud