Managed settings

An organization can put a file of settings on each computer, with MDM or by hand as an administrator. Its settings win over each person’s settings.toml, and can’t be changed from Settings or the command line.

Platform	Where
macOS	/Library/Application Support/Alto/managed.toml
Linux	/etc/alto/managed.toml
Windows	C:\ProgramData\Alto\managed.toml

It takes effect at once, with no restart, and taking it away gives everyone their own settings back.

What it can set

Any setting of settings.toml, by the same name, and a few only it can:

# Pairing with devices outside the tailnet's own: "on" (the default),
# "tailnet" (only devices Tailscale can name), or "off" (none, either way:
# no code shown here, none taken, and this device pairs with nobody).
pairing = "off"

# Notifications to phones go through Alto's relay, which is outside your
# network. "off" sends none; an address sends them through your own.
relay = "off"
# relay = "https://notify.example.com"

# Any setting of settings.toml, which then can't be changed:
keep_awake_after = "5m"
remote_access = true
trust = ["tag:ci", "*@example.com"]

# Rules (see Access): forbids no grant gets past, grants, and groups for
# them. A broken file lets nothing in from other devices or agents.
[groups]
eng = ["*@eng.example.com"]

[[forbid]]
src = ["*"]
dst = ["*"]
verbs = ["spawn"]
unless = { src = ["group:eng"] }
because = "only engineering starts sessions here"

The rules work as in Access, and people can’t change them. Each time the file is added, changed or removed, the log says so, with a hash of what it holds.

What people see

alto settings marks each managed setting “(set by your organization)” and names the file; alto settings --json lists them under managed. The app’s Settings window says “Set by your organization” under each one, and names them and the file at the bottom. Changing one is refused, saying where it’s set:

$ alto settings keep-awake 10m
alto: keep_awake_after is set by your organization (/Library/Application Support/Alto/managed.toml), so it can't be changed here

alto pair, with pairing off:

alto: pairing is turned off by your organization (/Library/Application Support/Alto/managed.toml)

A file that can’t be read turns pairing and the relay off rather than on.

What it can’t do

These are kept by Alto’s own service, which runs as each person. They make Alto do what the organization says for anyone using it as it comes; someone who can run programs of their own as themselves can run another copy without them. For a boundary that holds against that, run people’s and agents’ sessions as accounts or in sandboxes that the organization controls.