Your Mac's Terminal in Your Pocket. Orchestrate Your Agents From Anywhere

ALLOCX — Thu, 03 Sep 2026 17:38:28 +0000

I don't want to be chained to my desk to kick off a run or check on an agent.

An idea shouldn't have to wait until I'm back home. If it hits me on the subway, I want to open my phone, drop into my Mac, and set it in motion. That's the whole point of this setup: your Mac's full terminal, in your pocket, over LTE. No open ports, nothing exposed to the internet.

Tailscale + Termius. Tested end to end on a real machine, not from memory. About 20 minutes.

This is written for a Mac on the computer side, and works the same whether your phone is an iPhone or Android.

Before you start

Order matters. You install the key and test the connection before you turn passwords off. Do it the other way around and you'll lock yourself out of your own machine.

Part 1. On the Mac

Install Tailscale.

brew install --cask tailscale-app

It'll ask for your admin password.

Open Tailscale.app and log in. Google, GitHub, mail, whatever you use. Write down which one, because the phone has to log in with the same account.

Turn on MagicDNS. Go to login.tailscale.com/admin/dns and enable it. Without this you have to remember an IP. With it, your Mac gets a fixed name.

Turn on SSH.

sudo systemsetup -setremotelogin on

Then go to System Settings, General, Sharing, Remote Login, and pick "Only these users" with your account. Don't leave it open to everyone.

Keep it awake while it's plugged in.

sudo pmset -c sleep 0 disksleep 0
sudo pmset -a womp 1

A sleeping Mac doesn't answer, no matter how well everything else is configured. On battery it'll sleep anyway, and that's fine. There's no way around it.

Note your machine's name.

tailscale status

You'll see something like your-macbook.tailXXXX.ts.net. That's the name that goes in Termius. If the command isn't found, use the long path:

/Applications/Tailscale.app/Contents/MacOS/Tailscale status

Install tmux.

brew install tmux

This is what keeps you from losing the session when your signal drops.

Part 2. On your phone (iPhone or Android)

Download Tailscale from the App Store (iPhone) or Google Play (Android). Log in with the same account from Part 1. Leave the VPN on. That's what gives you access.

Download Termius from the App Store or Google Play. Same app on both.

Generate the key inside the phone. Termius, Keychain, +, Generate key, type Ed25519, name it phone.

Export the PUBLIC key and send it to yourself. Open the key you just made, share the public one (it starts with ssh-ed25519). Email it to yourself, or use AirDrop on iPhone / Nearby Share on Android. The private key never leaves the phone.

Don't copy an existing key onto the phone. Generate it there, like the step above. Lose the phone, and you delete one line. Done. You never touch your GitHub keys or anything else.

Part 3. Connect

Paste the public key on the Mac.

echo 'ssh-ed25519 AAAA...the-one-you-sent phone' >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Replace the text with the full key you sent yourself. It all goes on a single line. Watch the double >>. With a single > you wipe the file.

Check it landed right.

ssh-keygen -l -f ~/.ssh/authorized_keys

It should list your phone key. If it throws an error, the paste got cut off.

Create the host in Termius.

Address: the name from Part 1
Username: your Mac user, get it with whoami
Port: 22
Key: phone

Connect. It should go straight in, no password. If it asks for a password, the key isn't set right. Don't move on until this works.

Set tmux as the startup command.

tmux new -A -s phone

This goes in the host's config in Termius, in the startup command field. Now if the LTE cuts out in a tunnel, you reconnect and everything's exactly where you left it.

Part 4. Close the door

This part goes only after the connect step above worked.

Turn off password login.

sudo tee /etc/ssh/sshd_config.d/200-hardening.conf <<'HARDEN'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
HARDEN

The 200 in the name matters: it has to sort after the 100-macos.conf that's already there.

Validate before restarting.

sudo sshd -t

If it says nothing, you're good. If it throws an error, fix it before going on, otherwise you leave SSH broken.

Restart SSH.

sudo launchctl kickstart -k system/com.openssh.sshd

Don't close that terminal. Leave it open until you've reconnected from the phone. It's your safety net if something went wrong.

Part 5. Confirm it worked

From the phone, already connected:

hostname

It should return your Mac's name. You're inside the right machine.

From the Mac:

tailscale status

Find your phone's line. If it says direct, you're going peer to peer and it's fast. If it says relay, it still works but with more latency, depends on your carrier's NAT.

Make sure passwords are really off:

sudo grep -r PasswordAuth /etc/ssh/sshd_config.d/

It has to say no.

The real test

Turn off your phone's WiFi and connect over LTE. If you get in, it works for real. If you only tested at home with both things on the same network, you haven't tested anything yet.

Two more things

If typing feels laggy, install mosh:

brew install mosh

It survives IP changes and echoes your keystrokes locally, so it feels instant even when the connection isn't. Termius supports it on both iPhone and Android. If it fails, set the server path by hand, /opt/homebrew/bin/mosh-server, because that folder isn't in the PATH an SSH session gets.

If you can't connect, check in this order: the Mac is awake and plugged in, the Tailscale VPN is on on the phone, and both show up in tailscale status. It's almost always the first one.

That's it. Set it up once, and the distance between an idea and a running agent becomes the time it takes to unlock your phone.

For agents

If you'd rather hand this off, drop the prompt below into your agent. Fill in your phone OS and it'll fetch this article, adapt the phone steps to your device, and walk you through it. The computer side is Mac only.

Fetch this article and build me a step by step plan to implement it:
https://dev.to/allocx/your-macs-terminal-in-your-pocket-orchestrate-your-agents-from-anywhere-1e64

My setup:
- Computer: macOS [YOUR VERSION, e.g. Sequoia 15]
- Phone: [iPhone (iOS 18) OR Android 15]

The article is for macOS + iPhone/Android. Keep all the Mac commands as
written (Homebrew, SSH hardening, pmset), and use the phone steps that
match my device:
- Download Tailscale and Termius from the App Store (iPhone) or Google
  Play (Android).
- Generate the key inside Termius and share the public key the right way
  for my phone (AirDrop on iPhone, Nearby Share on Android, or email).
- Keep the same safety order: install the key and confirm the connection
  BEFORE disabling password login, so I never lock myself out.

Give me the plan as numbered steps with the exact commands to run, and
tell me how to verify each part worked before moving on.

Set the two lines to your Mac version and your phone before you run it.

DEV Community: ALLOCX