Remote access with Tailscale

Alto has Tailscale built in for remote access. With Tailscale on both ends, sessions on any of your machines work as your own, from anywhere in the world: as tabs in the window, and from the command line. Nothing listens on the LAN or the internet, and there are no ports to open or SSH keys to manage.

Your own devices

Devices signed in to the same Tailscale account need nothing more: remote access is on by default. Check what Alto sees:

alto remote-access          # on or off, Tailscale's state, and your devices running Alto
alto remote-access on

Then use any of them by its Tailscale name:

alto --on studio ls
alto --on studio attach 2
alto --on studio new -- claude
alto waiting                # what needs you, on every device you reach

In the window

The menu beside + opens a new tab on any of your devices, in any of its profiles. The tab is marked with the computer’s name in a chip of its own color, and the window title says “on studio”.

A tab whose link drops is shaded and says so, and reconnects by itself. Over a slow link you see the current screen at once and catch up with a fresh snapshot, rather than replaying a flood of output. If a session ends there, its tab shows Run again, as a local one would. Closing the tab ends the session there, even when the link is down.

Settings → Devices lists your devices and the ones that reach this one, and blocks or forgets any of them.

Someone else’s device

A device on another Tailscale account pairs once:

# on the device being reached
alto pair                    # shows a pairing string, e.g. studio:482913

# on the other device
alto pair studio:482913
alto pair studio:482913 --name sams-mac   # call it something else here

Trusting more than your account

For servers and teams, let devices in without pairing by a Tailscale tag, a person or a domain:

alto devices trust tag:ci
alto devices trust sam@example.com
alto devices trust '*@example.com'
alto devices trust            # list what's trusted
alto devices untrust tag:ci   # their connections end within seconds

Tagged devices trusted this way are also listed as yours, to open tabs on. See Servers and containers.

Managing devices

alto devices                  # those you reach, and those that reach this one
alto devices forget studio    # undo a pairing; its connections end at once
alto devices block laptop     # turn one away (your own included), keeping it listed
alto devices allow laptop     # let it back in

Security

• The server listens only on this computer’s Tailscale addresses, never on the LAN or the internet, on port 7655 (remote_port in settings).
• Tailscale encrypts the connection and says which device and user is on the other end.
• A device on your own Tailscale account is trusted. Anyone else’s must pair, which binds its token to the device Tailscale saw pair.
• Every device proves who it is. Each has its own Ed25519 key, made the first time its server runs. Before a pairing code or token is sent, the other end must prove it holds the key of the device you mean; the pairing string ends with that key’s fingerprint (studio:482913:7KQ2-M9XD-RT4B-0A6C). If another key answers, nothing is sent, and you’re told so.
• Codes and tokens are only ever sent to devices Tailscale knows on your tailnet. A pairing code works once, for five minutes, with five wrong tries.
• remote_access = false in settings, or alto remote-access off, turns it all off.

From your phone Planned · Phase 6

Planned: native iPhone and Android apps over the same Rust core and protocol, with a list of sessions with what each is doing, a notification when one needs you, and the terminal itself to read the output, answer a prompt or approve a step. Adding the phone will be scanning a QR code of the same pairing string alto pair shows.