deploy/relay.sh      bring the tunnel up on a fresh jump host
bin/healthcheck.sh   probe the relay (needs RELAY_TOKEN) and exit non-zero if down
bin/rotate-token.sh  ask the relay to mint a new operator token
.env.example         copy to .env and fill in, never commit the result

Notes

Credentials live in .env, which is gitignored. If you need a token, run bin/rotate-token.sh against a host you control rather than copying one out of a running box.