2026 Halo global ingress decision matrix
SSH ed25519-CA short certs, JumpHost chain, session audit, OpenClaw loopback

This checklist extends the Halo ingress series: pair it with QUIC and Happy Eyeballs SSH p95, MSS and BBR, OpenClaw loopback SSH gateway, multi-region JumpHost health proxy, and GeoDNS entry matrix. Public pages only: help, pricing, home.

1) Long-lived user keys hide revocation lag. 2) Each extra ProxyJump multiplies KEX work unless you cache ControlMaster wisely. 3) Split health and gateway sockets double forwards and blur p95 when dashboards merge streams.

Treat step-ca provisioning as a pipeline metric, not a one-time install. Emit histograms for signing latency, queue depth, and failure classes separately from sshd auth success so operators can tell smallstep backoff from packet loss across JP, KR, HK, SG, and US West.

JumpHost chain acceptance and per-hop handshake budgets

Use one regional bastion per logical path. Log ProxyJump timings with hop index tags. Prefer ControlMaster for interactive sessions but avoid long idle multiplexers on shared CI hosts because they mask stale Validity windows. When automation must reconnect hourly, measure fresh full handshakes without master sockets so p95 reflects worst-case renewals.

Session audit signals that survive multi-hop routing

Attach certificate serial and Principal to every tty or forced command log line. Ship logs off-box before the last hop so a compromised builder cannot erase evidence. Correlate bastion session identifiers with downstream OpenClaw request identifiers when LocalForward bridges the control plane.

OpenClaw loopback gateway, LocalForward, and merged read-only health

Bind the OpenClaw gateway and a read-only health slice on the same loopback interface inside each vpshalo region. From your laptop or CI runner, open a single LocalForward through the bastion to that loopback port. Merge gateway traffic with a lightweight JSON health route so agents read one socket instead of opening parallel forwards for doctor and gateway lanes.

When scaling to multiple regions, repeat the pattern per PoP and keep dashboards split by metro. Never expose the merged listener publicly; always terminate SSH on the bastion first. This mirrors the merged probe strategy in frp STCP loopback health but keeps everything inside classic SSH tooling.

Decision matrix: Validity versus Principal versus ForceCommand load

Score each workload row before editing sshd_config. Owners must sign the row in change management.

# ~/.ssh/config fragment: two-hop with merged local forward
Host halo-bastion
  HostName bastion.example
  User jump

Host halo-openclaw
  HostName 127.0.0.1
  ProxyJump halo-bastion
  LocalForward 18765 127.0.0.1:18765
  IdentityFile ~/.ssh/id_ed25519
  CertificateFile ~/.ssh/id_ed25519-cert.pub

JP, KR, HK, SG, US West: SSH handshake p95 split checklist

Targets assume a single ProxyJump plus one LocalForward to merged loopback health. Add thirty milliseconds per extra hop when you file exceptions.

Six rollout steps tying certs, jumps, and OpenClaw health together

• 1 Publish TrustedUserCAKeys on every bastion with dual CA overlap for two weeks.
• 2 Cut Validity for humans to twelve hours and bots to ninety minutes; monitor issuance latency per region.
• 3 Normalize Principal namespaces and remove wildcard principals except documented break-glass roles.
• 4 Chain ProxyJump with per-hop timers exported to the same store as TLS ingress metrics.
• 5 Collapse OpenClaw gateway and read-only health onto one loopback listener per PoP; document the LocalForward port.
• 6 Sign off p95 rows for JP, KR, HK, SG, and US West before enabling unattended renewals.

Cite in reviews: Validity shorter than renewal SLA guarantees brownouts. Principal sprawl defeats ForceCommand clarity. Merged loopback health cuts duplicate forwards and stabilizes charts.

Green rows in your region? Map the bastion to the same metro as your remote Mac builder on purchase, then refine with Tokyo, Seoul, Hong Kong, Singapore, or US West carts.