Reins

Approve agents away from home, over Tailscale

Reins has no relay: the phone connects to your machine. On the same network that works out of the box. From a café, the train or another city, the phone needs a route to the machine, and Tailscale is the easiest one to give it.

Why a route is needed at all

Tools with a relay reach your laptop from anywhere because both ends dial out to a server. Reins removes the server, so it inherits the server’s job: your machine has to be reachable from the phone. That is the whole trade, and it is listed with the others on the home page. Tailscale makes the machine reachable without opening a port on your router, and Reins knows how to use it.

Put both ends on one tailnet

  • Install Tailscale on the machine that runs your agents and sign in.
  • Install the Tailscale app on the phone and sign in to the same tailnet.
  • Leave sshd listening as it is; Tailscale carries the SSH connection, it does not replace it.

Then ask reins which addresses a phone can use right now:

reins routes
reins tailnet

routes lists LAN addresses first, then Tailscale, without duplicates. It is the same list reins pair puts in the QR, and the app asks for it each time it connects and merges the answer into what it already has. So a machine that gains Tailscale after you paired becomes reachable away from home without pairing again. tailnet lists the machines on the tailnet, which is what the app’s pairing screen offers in its picker.

Pair without being at the machine

reins pair --remote

This turns on remote pairing with a five-word passphrase, shown once. A phone on the same tailnet, or the same network, can then pair by typing it, with no QR in front of you. Five wrong tries lock it for an hour; running the command again makes a new passphrase, and --remote-off turns it off. Phones already paired keep working either way.

Switching networks

The phone probes every route it has and uses whichever answers, so approvals carry on after a switch from Wi-Fi to cellular. An open terminal does not yet; reopen it after the switch and the shell is where you left it.

What Tailscale adds to the path

Reins adds nothing between your phone and your machine. Tailscale does: its coordination servers hand out keys and addresses, and when no direct path exists between the two devices it relays the encrypted packets through its own servers. WireGuard means it cannot read them, but it is in your network path and you should know that. Any VPN that gives the phone a route to the machine works the same way, with the same caveat.

A non-standard SSH port

If sshd listens somewhere other than port 22, tell reins once: reins pair --ssh-port N for the QR and reins serve --ssh-port N for what it announces. Reins also reads a port from ~/.reins/sshd_config when there is one.

Check it from outside

Turn Wi-Fi off on the phone, open Reins, and ask an agent for something that needs an answer. If the request does not arrive, reins routes on the machine should list a Tailscale address; if it does not, Tailscale is not up on that side. If it does, check the phone’s Tailscale app is connected. Then troubleshooting.