What’s a safe, inexpensive way to use SSH from a locked-down library computer?

For a self-hosted browser terminal, ttyd or Gotty is probably closer to what you want than Cockpit. They expose a terminal through a web page using a WebSocket connection and have much less overhead than a full administration dashboard. Put it behind HTTPS, require strong authentication, and ideally restrict access with a VPN or identity-aware proxy rather than exposing an unauthenticated terminal to the internet.

A Chrome SSH extension can connect directly to an SSH server without needing a separate web terminal backend. One option is based on hterm and even includes experimental Mosh support. The main limitation is that it may be restricted to a particular browser, and the library network could block outbound SSH connections. You’d also want to be very careful about leaving keys, passwords, or shell history behind on a shared computer.

A hosted browser IDE such as Codespaces or a provider’s web console would work if you’re comfortable using a larger environment, but it’s probably more than you need. For a simple VPS workflow, a small VPS plus a properly secured ttyd-style service is the most direct approach. If your goal is only editing, testing, and running scripts, you don’t need a full VS Code setup.

Tailscale is a good choice for avoiding an openly exposed SSH port, but it doesn’t by itself give you a terminal page in an ordinary browser. You’d still need a browser-compatible terminal service or a device that can run the Tailscale client. If you use a Cloudflare tunnel instead, protect the published terminal with an access policy and MFA; don’t publish a raw shell endpoint without authentication.