Mounting a folder

Mounting a folder on your computer

A folder on the machine, opened on your own computer as if it were a local one: the Finder, Explorer or your file manager shows it, and any program there can open its files. Argus writes the commands for you, for macOS, Linux and Windows, and can let your key in so that nothing ever asks for a password.

Where: the ⋮ menu of a folder in the file browser, or the menu of a starred folder in the sidebar (right-click, or a long press) → Mount on your computer…. The wizard opens on the system you are looking at it from; the other two are a tab away.

To keep a copy that works offline instead, see Syncing a folder.

The fastest way: one command

At the top of the wizard is one line to paste in a terminal (PowerShell on Windows):

curl -fsSLk https://your-machine:8090/ssh-setup/<link>.sh | sh       # macOS, Linux
irm https://your-machine:8090/ssh-setup/<link>.ps1 | iex             # Windows

It does everything, in order, and says each step as it goes:

1. makes an SSH key if you have none (~/.ssh/id_ed25519; on Windows id_rsa, the one SSHFS-Win reads);
2. sends its public half back to the link, and Argus adds it to ~/.ssh/authorized_keys here — from then on, no password, ever;
3. installs what mounts the folder, if it is missing: FUSE-T and sshfs with Homebrew on a Mac (no change to macOS security settings, unlike macFUSE), sshfs with apt or dnf on Linux, WinFsp and SSHFS-Win with winget on Windows;
4. mounts the folder — at ~/mnt/<folder> (or where you said), as the drive Z: on Windows — and opens it.

The link is made for that folder, that user and that machine; it works once, for 15 minutes, and can let in one public key, no more. New link makes another. Changing a field (the machine's name, the port, where to mount it) makes a new one by itself.

What a bare computer lacks

The script installs what is missing and says so: the SSH client on Linux (apt, dnf, zypper or pacman) and Windows (the OpenSSH client feature, as administrator); Homebrew on a Mac; on Windows without winget, the WinFsp and SSHFS-Win installers from their releases. A script that stopped half-way (no network, a refused password) is simply run again: the same link takes the same key again.

A Mac account that is not an administrator (Sorry, user … may not run sudo) cannot mount at all: Homebrew and FUSE-T install system parts. The script says so, shows how big the folder is and offers the other way instead — a copy in ~/<folder> kept in sync both ways by Mutagen, fetched into ~/.local/mutagen, no administrator needed. It asks first.

When another account on the Mac is an administrator, it can install the tools for you, and your own account then uses them. Homebrew lives in /opt/homebrew on a Mac with an Apple chip (M1, M2…) and in /usr/local on an Intel one — uname -m answers arm64 or x86_64. The wizard writes the commands for the one you pick.

su - youradmin                  # asks that account's password; then, as that account:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
eval "$(/opt/homebrew/bin/brew shellenv)"      # Apple chip
eval "$(/usr/local/bin/brew shellenv)"         # Intel
brew install macos-fuse-t/homebrew-cask/fuse-t macos-fuse-t/homebrew-cask/fuse-t-sshfs
exit

Back in your own account, the same eval line (and once into your profile, so a new terminal finds brew and sshfs too), then the wizard's line again: it finds sshfs and mounts.

eval "$(/opt/homebrew/bin/brew shellenv)"      # or /usr/local/bin/brew on Intel
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' | tee -a ~/.zprofile ~/.bash_profile >/dev/null

Step by step

Under Step by step, to see what it does are the same four steps as separate commands, each with a copy button — for when you would rather run them one at a time, or the machine cannot be reached from your computer the way the browser reaches it:

1. A key: make one and copy it. Then either paste it into the wizard and press Let this key in (Argus adds it, no password needed even this once), or run ssh-copy-id (asks the password once). ssh you@machine echo ok should then answer ok with no password.
2. The tool, once: FUSE-T + sshfs, sshfs, or WinFsp + SSHFS-Win.
3. Mount it, and how to unmount it (umount, fusermount -u, net use Z: /delete).
4. Or keep a copy in sync with Mutagen: a local copy that follows the folder both ways and works offline.

A mounted folder is read over the network when a file is opened: right for reports, figures and documents; slow for a 10 GB FASTQ. For big files, the copy in sync is the better way.

The fields

user	the account Argus runs as on the machine
machine	the name (or address) your computer reaches it by; the list offers the ones the machine answers to
port	SSH's port, read from the machine's sshd_config (22 when it does not say)
mount it at	where the folder appears on macOS and Linux
drive (Windows)	the drive letter on Windows

Who can do this

Letting a key in gives that key a shell on the machine. Whoever holds Argus's full token has a terminal here already, so it is no new power — but it is that token's alone: never a device key, an agent's key or a watcher's (POST /api/ssh/authorize and POST /api/ssh/setup answer 403 to them). Only one well-formed public key line is accepted, it is added once (a second time says already let in), ~/.ssh is kept at 0700 and authorized_keys at 0600. The one-command link itself is the secret: anyone who has it within its 15 minutes can let in one key — so paste it in your own terminal, not in a chat.