Hosts

Hosts

Hosts is where one Mac becomes a fleet. The Mac you sit at is the admin; the Macs it manages are hosts — a rack of Mac minis, say, or a spare Mac under a desk. Admins and hosts talk directly, over TLS on your own network, with no server in between.

Both roles run their own containers. "Host" only means another Mac may manage this one. The role is chosen on first run and changed in Settings ▸ Hosts and Fleet; a configuration profile can set it. An admin listens on nothing; a host listens on port 7868 for the admins it trusts.

The Hosts list

One row per Mac: This Mac first, then every host you have paired. A coloured dot gives each one's state: connected; container stopped, in amber, when its Flotilla answers but container is not running; not answering; or waiting for approval, when it asked to join with your enrolment key.

The filter offers All, Connected, Waiting for approval and Needs attention. A row shows Containers, Machines, Model, macOS, container and Flotilla, with a mark where a version differs from This Mac's. Every Mac carries a built-in tag — This Mac, Admin or Host — beside your own.

Rows have a checkbox, a Sort menu, a hover action and ⋮, and the selected Mac's page sits beside the list; see Views and filtering.

Group By arranges the list by Subnet, or by categories you define — Site, Rack, VLAN — with Edit Categories… to manage them. Categories stay on this admin; the host is not told.

Hosts are checked every 30 seconds while they answer, and less often while they do not, whether or not the window is open, so the menu-bar badge knows when a host goes quiet.

Adding a host

On the host, set Use this Mac as to Host and answer macOS's local network prompt. That click is the one thing a configuration profile cannot do for you: local network access is a per-user setting that MDM cannot grant.

Then, on the admin, Add Host. Pick a Mac Flotilla found over Bonjour, or By address to type a name such as mini.lan or an address such as 10.0.1.20. Bonjour does not cross networks, so a host in another office, or over a VPN, is added by address. Flotilla keeps the typed address, and SSH, Screen Sharing and File Sharing use it too.

With a pairing code

For a single Mac. On the host, Settings ▸ Hosts and Fleet ▸ Show Code shows an eight-character code like ABCD-EFGH. It lasts ten minutes and allows five wrong tries. Type it on the admin; then both Macs show the same four words. Compare them and confirm on both.

The words are the real check. They are computed from both Macs' keys and a fresh value from each, so a machine in the middle — which must present its own key to each side — cannot make the two screens agree. See Security model.

With the fleet enrolment key

For managed Macs, with nobody at the keyboard. Create Key in the admin's Host Mode tab makes one string, FLT1-…, that a configuration profile hands to every host. It names this admin and no other.

It is a key for asking, nothing more. Each host that uses it appears Waiting for approval, with when it asked and its serial number — approve only a Mac you recognise, checking the serial against your inventory. Approve, or Turn Away; with several waiting, select them and Approve 3. Replace… makes a new key: Macs given the old one can no longer ask, and Macs already enrolled stay.

A host's row menu

Open; Rename… (a name on this Mac only); Update Flotilla when one is due; Open in Terminal (SSH), Share Screen (VNC) and Connect to File Sharing (SMB); Keep Awake; Start, Stop and Restart Container System; Remove Access; tags, Group and Copy. Last, Remove….

The connections are macOS's own apps, opened at the host's address — not channels inside Flotilla's protocol — and the host's own sharing settings still decide whether they answer.

Remove Access blocks the host until you approve it again. Remove… forgets it: to manage it again, pair it again.

Each Mac's page

Overview · System · Flotilla · Updates · Settings · Activity — the same for This Mac as for a host, because a page that differs for one Mac is a page you have to learn twice.

A paired host's page adds three tabs after a divider: SSH · Files · Screen Sharing. See SSH, Files and Screen Sharing. This Mac's page has none of them. It does not connect to itself.

• Overview — that Mac's notices first, each with its fix; then its state, with Start, Stop… and Restart… where allowed, hardware, what is running, versions and usage.
• System — serial number, macOS, FileVault, firewall, addresses, sharing services and power, with Recommended for a host: the energy settings a host is best set to, each with Apple's guide. Flotilla recommends them and never changes them.
• Flotilla — version, install, Helper, host switches, fingerprint, address block and DNS zone.
• Settings — every Flotilla setting on that Mac, read-only, sensitive ones without their value.
• Updates — see Updates.

A host on an older Flotilla reports less, and the newer facts show as a dash with a note.

SSH, Files and Screen Sharing

Three tabs on a paired host's page are macOS's own ways in. Flotilla has no remote shell of its own. These use this Mac's ssh, Finder and Screen Sharing, with your own login on the host, and the host's own sharing settings still decide whether they answer.

Each tab has a dot: green when the service is on at that host, red when it is off, grey when the host has not said. An older Flotilla on the host reports nothing, which shows as grey, never as off. A host works out whether the service is on by checking whether anything is listening for other Macs on ports 22, 5900 and 445.

Connect as names the user. It is set on the host's System tab and on the SSH tab, and is kept with the host on this Mac. Left empty, Flotilla uses the user signed in on the host.

Clicking a tab shows a page. It starts nothing. The page's button does that.

If the service is off or unknown, the page says what it is, where its switch is (System Settings ▸ General ▸ Sharing on the host), and links Apple's instructions. The report is a port check, and your own ssh config may use another port, so the button is still there, as … anyway.

SSH

Start SSH Session opens a real terminal in the tab, running this Mac's /usr/bin/ssh to the host. The page shows the exact command first. Flotilla gives ssh only the host and the user, plus its own key when it has one. It adds no other options, no command and no shell. Your keys, agent and ~/.ssh/config all work. If the host asks for a password, you type it into the terminal. Flotilla passes your keystrokes through and keeps them nowhere, and it never stores or logs a password or passphrase.

You can open more sessions. A tab that already has a session goes straight to it.

Sign in with an SSH key says whether a session will ask for a password. It lists the keys you already have, and Flotilla never changes, copies or reads them. Set Up SSH Key… shows three steps, each a button with a sentence saying what it runs, in the tab's terminal:

1. Make a Key. Runs ssh-keygen to make Flotilla's own key, ~/.ssh/flotilla_ed25519. It asks for a passphrase. Flotilla uses this key for its hosts only. Sessions use it while it exists.
2. Copy Key to the host. Runs ssh-copy-id. The host asks for its password once. The private key stays on this Mac.
3. Try It. Starts a session. It should go straight in.

Once there is a key, you can also:

• Regenerate Key… It first lists every step. It sets the old pair aside, as flotilla_ed25519.old-<date>, and deletes nothing. It then makes a new key, puts it on this host, and, if you leave the box ticked, takes the old key's lines off the host's authorized_keys. It saves that file as authorized_keys.flotilla-bak first, and changes nothing unless the new key is already in it. Other hosts that had the old key are each offered Copy to … too.
• Remove Key from This Host… Takes Flotilla's key off the host's authorized_keys the same way, and leaves the key on this Mac.

Only one key step runs at a time, across all hosts. The page also shows the commands for doing it by hand in Terminal.

Files

Open in Finder opens smb:// in Finder, which mounts the host's shared folders. You sign in as a user on the host. Nothing is browsed in the Flotilla window. This is the host's File Sharing and nothing to do with the container Files tab.

Screen Sharing

Open Screen Sharing opens vnc:// in macOS's Screen Sharing app. On a managed Mac, Remote Management includes it, and the page links Apple's instructions for both.

The address is the one Flotilla already uses for the host. A host found over Bonjour is reached by its .local name.

What the host's owner keeps

A paired admin manages a host's containers fully — their settings, environment variables and mount paths included — so a host should pair only with its own admin. But some switches are the host's, in its Host Mode tab, and an admin cannot change them:

• Let its admin start and stop container — on by default. Off, the admin sees that container is stopped but cannot start it, and its buttons say why.
• Install Flotilla updates from its admin, and Install and upgrade container by itself.
• Keep this Mac awake for its admin — on by default: host mode holds off system sleep, never on battery.
• The list of Admin Macs trusted by this Mac, with Remove and Allow Again.

Stopping or restarting a host's container asks first and says how many containers will stop. They do not come back on their own.

The admin can change one setting for a host: Start container by itself — after the Mac starts up, ask, or never — unless a profile locks it there.

If a host's owner has turned keep-awake off, the admin can still ask, with Keep Awake ▸ For 1 Hour, For 4 Hours or Until 9:00 Tomorrow. A request lasts at most a day, so a forgotten one ends by itself, and a host on battery refuses it.

Forget all hosts and trust

Settings ▸ Advanced ▸ Reset ▸ Forget all hosts and trust is for starting a fleet again from nothing, a key you suspect, or a Mac you are passing on. It forgets every Mac you have paired with, deletes this Mac's own identity and your fleet enrolment key, and returns the forgotten hosts' address blocks.

This Mac gets a new identity, so every Mac has to pair again from scratch, and each one's owner has to let this Mac back in: the fingerprint they trusted no longer exists. Macs you turned away or removed stay blocked — that block is about their keys, which the reset does not change. A key from a configuration profile is the organisation's and is left alone. Containers, images, volumes, settings and window layout are untouched. The button is disabled, not hidden, when there is nothing to forget.