Remote access with Tailscale

Alto has Tailscale built in for remote access. With Tailscale on both ends, sessions on any of your machines work as your own, from anywhere in the world: as tabs in the window, and from the command line. Nothing listens on the LAN or the internet, and there are no ports to open or SSH keys to manage.

Your own devices

Devices signed in to the same Tailscale account need nothing more: remote access is on by default. Check what Alto sees:

alto settings remote-access          # on or off, Tailscale's state, and your devices running Alto
alto settings remote-access on

Then use any of them by its Tailscale name:

alto --on studio ls
alto --on studio attach 2
alto --on studio new -- claude
alto ls --waiting           # what needs you, on every device you reach

In the window

The menu beside + opens a new tab on any of your devices, in any of its profiles. The tab is marked with the computer’s name in a chip of its own color, and the window title says “on studio”.

A tab whose link drops is shaded and says so, and reconnects by itself. Over a slow link you see the current screen at once and catch up with a fresh snapshot, rather than replaying a flood of output. If a session ends there, its tab shows Run again, as a local one would. Closing the tab ends the session there, even when the link is down.

Settings → Devices lists your devices and the ones that reach this one, and blocks or forgets any of them.

Someone else’s device

A device on another Tailscale account pairs once:

# on the device being reached
alto pair                    # shows a pairing string, e.g. studio:482913

# on the other device
alto pair studio:482913
alto pair studio:482913 --name sams-mac   # call it something else here

Trusting more than your account

For servers and teams, let devices in without pairing by a Tailscale tag, a person or a domain:

alto devices trust tag:ci
alto devices trust sam@example.com
alto devices trust '*@example.com'
alto devices trust            # list what's trusted
alto devices untrust tag:ci   # their connections end within seconds

Tagged devices trusted this way are also listed as yours, to open tabs on. See Servers and containers.

Managing devices

alto devices                  # those you reach, and those that reach this one
alto devices forget studio    # undo a pairing; its connections end at once
alto devices block laptop     # turn one away (your own included), keeping it listed
alto devices allow laptop     # let it back in

Security

• The service listens only on this computer’s Tailscale addresses, never on the LAN or the internet, on port 7655 (remote_port in settings).
• Tailscale encrypts the connection and says which device and user is on the other end.
• A device on your own Tailscale account is trusted. Anyone else’s must pair, which binds its token to the device Tailscale saw pair.
• Every device proves who it is. Each has its own Ed25519 key, made the first time its service runs. Before a pairing code or token is sent, the other end must prove it holds the key of the device you mean; the pairing string ends with that key’s fingerprint (studio:482913:7KQ2-M9XD-RT4B-0A6C). If another key answers, nothing is sent, and you’re told so.
• Codes and tokens are only ever sent to devices Tailscale knows on your tailnet. A pairing code works once, for five minutes, with five wrong tries.
• remote_access = false in settings, or alto settings remote-access off, turns it all off.

From your phone

Native iPhone and Android apps, over the same Rust core and protocol: your machines with their sessions under each, what each is doing, and the terminal itself, to read the output, type, or answer an agent’s prompt with Allow or Deny. When a session needs you, the phone gets a notification, sent by that machine’s service whether or not any window is open, and tapping it opens the session. A machine on your own Tailscale account is added by name, or picked from the ones the phone finds; someone else’s by scanning the QR code alto pair (or Settings → Devices) shows. The iPhone app is in TestFlight and the Android app is built; neither is in the stores yet.