RoachTailYour devices, paired
How it works
- The Mac keeps the device list and the join code. No RoachNet server is involved.
- A join code pairs once, expires after 10 minutes, and retires after five wrong guesses.
- Each device gets its own token at pairing, sent once. The Mac keeps only a SHA-256 hash of it and compares tokens in constant time.
- A device token that goes unused for 90 days stops working (
ROACHTAIL_PEER_IDLE_DAYS;0turns that off). - Linked devices on the Mac removes one device without touching the rest.
- Your Vault's contents don't move through RoachTail's control state.
Pair a phone
Turn on RoachTail on the Mac, then pair from the iOS companion with the join code. Install the iOS companion has the steps.
Reaching the Mac
The companion bridge listens on the Mac's loopback address only. To reach it from a phone you need a secure path you control:
- Your tailnet. The companion sends its token inside a tailnet (Tailscale addresses and
*.ts.netnames). - A relay you run yourself, over HTTPS. Set it with
ROACHTAIL_RELAY_HOST, or as the runtime's advertised companion URL.
The companion refuses plain http:// to a .local name or a Wi-Fi address.
The RoachNet name
Setup points the name RoachNet at the Mac's loopback address in /etc/hosts, asking once for an administrator password when the file needs the change. roachnet-runtime --provision-alias --print-command prints the command it uses, so you can run it yourself. See Command line.