remote made more sense as 'workflow'
enable forwarding separately
absolute certificates when setting up, fixed rsync clud fn