Add remote-chromium.sh and install waypipe in setup-local.sh

Runs Chromium on the home machine with its window drawn on the travel
laptop, so logged-in browser accounts stay on the home machine. Closes
any running instance first, since Chromium's one-process-per-profile
lock would otherwise open the window on the home machine's own screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -140,6 +140,18 @@ LUKS-encrypted later, this recovery path breaks (nothing starts until
 someone types the disk passphrase locally) unless something like
 `dropbear-initramfs` is added for remote unlock.
 
+## Single remote app: Chromium with your logged-in accounts
+
+`remote-chromium.sh` (run on the travel laptop) closes any Chromium you have
+running on the home machine, then launches it there with its window drawn
+locally via `waypipe` (`--x11` for classic X11 forwarding instead). The close
+step matters: Chromium allows one process per profile, so a still-running
+instance would swallow the new window onto the home machine's own screen.
+Needs `waypipe` on both ends (`setup-local.sh` installs it locally; on the
+home machine: `sudo apt install waypipe`). Untested against Tailscale SSH,
+which may not support the socket/X11 forwarding these rely on - if the
+connection fails, plain OpenSSH is the fix.
+
 ## Gotchas hit while building this (so they don't get re-debugged)
 
 - **`usermod`/`visudo`: command not found** after `su` - not missing, just

remote-chromium.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Run on the travel laptop: closes any Chromium running for you on the remote
+# machine (Chromium allows one process per profile, so a running instance
+# would swallow the new window), then launches it there with its window
+# drawn here.
+#
+# Usage: remote-chromium.sh [--x11]     (default: waypipe)
+# Remote host: $REMOTE_HOST, default teemu-thinkpad-ubuntu
+set -euo pipefail
+
+HOST="${REMOTE_HOST:-teemu-thinkpad-ubuntu}"
+MODE="waypipe"
+[ "${1:-}" = "--x11" ] && MODE="x11"
+
+if [ "$MODE" = "waypipe" ] && ! command -v waypipe >/dev/null 2>&1; then
+  echo "waypipe not installed here - run: sudo apt install waypipe (needed on both machines)"
+  exit 1
+fi
+
+ssh "$HOST" bash -s <<'EOF'
+# snap build (Ubuntu) and the Debian package - matches the browser binary only,
+# not shells/editors that merely mention "chromium"
+PAT='chromium-browser/chrome|/usr/lib/chromium/chromium'
+if pgrep -u "$USER" -f "$PAT" >/dev/null; then
+  echo "Chromium is running on $(hostname) - closing it gracefully..."
+  pkill -TERM -u "$USER" -f "$PAT"
+  for _ in $(seq 1 10); do
+    pgrep -u "$USER" -f "$PAT" >/dev/null || break
+    sleep 1
+  done
+  if pgrep -u "$USER" -f "$PAT" >/dev/null; then
+    echo "Still running after 10s - force killing."
+    pkill -KILL -u "$USER" -f "$PAT"
+  fi
+fi
+EOF
+
+case "$MODE" in
+  waypipe) exec waypipe ssh "$HOST" chromium --ozone-platform=wayland ;;
+  x11)     exec ssh -X "$HOST" chromium ;;
+esac

setup-local.sh

@@ -159,7 +159,7 @@ install_packages() {
   fi
 
   if sudo apt-get update -qq && sudo apt-get install -y -qq \
-      vim tmux mosh git curl ca-certificates jq gnupg firefox-esr code >/tmp/apt-install.log 2>&1; then
+      vim tmux mosh git curl ca-certificates jq gnupg firefox-esr code waypipe >/tmp/apt-install.log 2>&1; then
     step_ok "apt packages"
   else
     step_fail "apt packages" "see /tmp/apt-install.log"