Keep your Mac reachable

For a day away, setting up Remote is enough. For longer trips, these steps keep the Mac reachable whatever happens: a restart, an update, a power cut. Do them at home, before you leave; each one is worth it on its own, and they add up.

1. The basics

• In Qispi Host’s menu, turn on Keep the Screen On While Remote Is Allowed, so the Mac doesn’t lock its screen while you’re away.
• In System Settings › Energy, turn on Start up automatically after a power failure (on a desktop Mac).
• Consider turning off automatic macOS updates while you’re away (System Settings › General › Software Update › Automatic Updates), so the Mac doesn’t restart into an update on its own.
• Connect the Mac to your router with an Ethernet cable if you can: it’s steadier than Wi-Fi, and it works before macOS has fully started (see step 4).

What happens when a Mac restarts

A Mac that restarts goes through three stages before Qispi can show it:

1. Locked at startup. With FileVault on (it usually is), the disk is locked until someone types the password. Nothing on the Mac runs yet, not even Tailscale.
2. At the login window. The disk is unlocked, but nobody is logged in, so Qispi Host isn’t running yet.
3. Logged in. Qispi Host starts with your session, and Qispi connects as usual.

The steps below get you through stages 1 and 2 from far away. Qispi will do both itself in a coming version, from the app; until then, they take two other apps on your iPad.

2. Tailscale as a system service

The Tailscale app runs only while you’re logged in. Installed as a system service instead, Tailscale starts with the Mac, so it’s there at the login window (stage 2).

On the Mac, in Terminal:

brew install tailscale
sudo tailscaled install-system-daemon
sudo tailscale up

Then quit the Tailscale app and remove it from System Settings › General › Login Items, so the two don’t compete. In the Tailscale admin console, open your Mac and choose Disable key expiry, so it doesn’t drop off Tailscale after a few months.

After each brew upgrade tailscale, run sudo tailscaled install-system-daemon again.

3. A subnet router at home

At stage 1, even the system service can’t run (it lives on the locked disk), so Tailscale can’t reach the Mac. A subnet router is another device at home that’s always on Tailscale and lets you reach your home network through it, and so the Mac’s own home address.

An Apple TV works well (a Raspberry Pi too):

1. Install Tailscale on the Apple TV and sign in with your account.
2. In its settings, turn on Subnet router, and give your home network, for example 192.168.1.0/24 (the first three numbers of the Mac’s home address, then .0/24).
3. In the Tailscale admin console, open the Apple TV › Edit route settings, and approve the route.
4. On your iPad, in Tailscale’s settings, turn on Use Tailscale subnets.

In your router’s settings, give the Mac a fixed address (often called a DHCP reservation), so it’s the same after every restart.

4. Unlocking FileVault from far away (stage 1)

Recent versions of macOS let you unlock FileVault over SSH before the Mac has started.

Once, on the Mac: System Settings › General › Sharing › Remote Login: on.

When the Mac is locked at startup, on your iPad:

1. Open an SSH app (for example Termius or Prompt).
2. Connect to the Mac’s home address (for example 192.168.1.20), not its Tailscale one, with your Mac user name.
3. The app warns that the Mac’s key is unfamiliar: that’s expected, it’s the startup screen’s own key. Accept it.
4. Type your Mac’s password. The Mac unlocks and goes on starting, up to the login window.

Never open SSH to the internet on your router for this: the subnet router is what makes it safe.

5. Logging in from far away (stage 2)

Once, on the Mac: System Settings › General › Sharing › Screen Sharing: on. For apps other than Apple’s own, also turn on VNC viewers may control screen with password in its options, and set a password.

When the Mac is at the login window, on your iPad:

1. Open a screen sharing app (for example RealVNC Viewer).
2. Connect to the Mac’s Tailscale address (Tailscale is running by then, as a system service). If the app asks about encryption, choose Prefer off: Tailscale already encrypts it.
3. Log in as you would at the Mac.

A few seconds later Qispi Host is running: close the screen sharing app and open Qispi.

6. Restarting on purpose

To restart the Mac yourself while you’re away, without going through stage 1, use this in Terminal (through Qispi):

sudo fdesetup authrestart

It restarts past the FileVault lock once, straight to the login window (stage 2).

When even that isn’t enough

If the Mac won’t start, is stuck in recovery mode, or is frozen, nothing above helps: that needs a device plugged into the Mac that acts as its keyboard and screen, an IP KVM (PiKVM, for example), reachable through Tailscale.

A second way in

If Qispi Host itself ever stops working while you’re away, a second remote access app on the Mac (Apple’s Screen Sharing over Tailscale, from step 5) lets you fix it.