Set up a Mac with herdr and Tailscale to reach your agents anywhere

The point of running coding agents in herdr is that they keep going without you. The point of this guide is to let you check on them without being at the desk. By the end your Mac runs herdr, is reachable over Tailscale from anywhere you have a connection, and accepts your phone through a key of its own. Nothing is forwarded on your router.

It takes about ten minutes, once. The examples use a Mac called studio-mac and the account alex; use your own names.

1. Install herdr and start an agent

On the Mac, install herdr with the script from its docs, or with Homebrew:

curl -fsSL https://herdr.dev/install.sh | sh
# or
brew install herdr

Check it with herdr --version, then open your project folder and start herdr with herdr. Run an agent in the first pane, for example claude or codex. herdr detects it and shows its state in the sidebar. If you detach later with ctrl+b q, the agent keeps running.

Herdr Pocket's Chat view, which shows an agent's replies as a conversation, needs herdr's integration for each agent you use. Check them with herdr integration status; if one doesn't read current, install it, for example herdr integration install claude, and restart that agent.

Prefer the Herdr app? Herdr Pocket also works with Herdr Core, its hc server, and its setup can install Herdr Core for you if the Mac has neither.

2. Turn on Remote Login

Remote Login is the Mac's built-in SSH server. Open System Settings › General › Sharing and turn on Remote Login. Click the info button next to it to see which users may log in; if you limit it, include your own account.

While you are in Terminal, note two things you will need later. Your short account name:

whoami

And the Mac's SSH host key fingerprint, so you can recognise the Mac when the phone connects:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

3. Install Tailscale on the Mac

Tailscale gives each of your devices a private address, such as 100.64.0.10, and a name on your tailnet, such as studio-mac. Connections between devices are encrypted with WireGuard and work through home routers and mobile networks without port forwarding.

1. Download the Standalone variant from Tailscale's macOS download page. Tailscale recommends it over the Mac App Store version.
2. Open it and allow the VPN configuration. On macOS 15 and later, also turn on Tailscale Network Extension under System Settings › General › Login Items & Extensions › Network Extensions.
3. Sign in from the menu bar icon. If your tailnet uses device approval, approve the Mac in the admin console.

The Mac now appears on the Machines page of the Tailscale admin console with its name and 100.x address.

Leave Tailscale SSH off on this Mac. It takes over port 22 for tailnet connections and authenticates with your Tailscale identity, so the phone's SSH key would be ignored. If you turned it on earlier, run tailscale set --ssh=false.

4. Keep the Mac awake

A sleeping Mac answers nobody. Agents only run while the Mac is awake, and the phone can only reach it then. On a desktop Mac, look in System Settings › Energy for the option that prevents automatic sleeping when the display is off. On a MacBook, the matching option is under Battery › Options and applies on the power adapter. For a single long run, caffeinate -s in a Terminal tab keeps the system awake while it runs on power.

5. Connect your phone

Herdr Pocket runs Tailscale inside the app, so the phone needs neither the Tailscale app nor a VPN profile. Its guided setup, Connect a Computer, does the rest:

1. Tap Connect a Computer, then Sign In to Tailscale, with the same account as the Mac. The phone joins your tailnet with its own name, such as herdrpocket-iphone-3fa91c.
2. Pick studio-mac from the list of your devices.
3. Enter your short account name, alex, and keep the key type on Ed25519.
4. Compare the fingerprint the app shows with the one you printed in step 2. Tap Trust only if they match.
5. Add the phone's key. Either type your Mac password once (it adds the public key, checks it works, and is never saved), or choose Run a Command Instead and paste the command into Terminal on the Mac yourself.
6. Tap Show Agents. The agents from your herdr session appear in the list.

Prefer to enter things by hand? Add Host takes the Mac's Tailscale name or address, port 22 and your username, as you would type after ssh.

6. Test it away from home

Turn off Wi-Fi on the phone and open the Mac again over cellular. The agents should load, and a new terminal should print a folder on the Mac when you run pwd. If it works there, it will work from a train or a café.

If something doesn't connect

• The Mac is listed as offline. Wake it and check that Tailscale shows as connected in its menu bar.
• It can't reach the Mac. Check that Remote Login is on and the Mac is awake. If you changed your tailnet's access rules, allow the phone to reach the Mac on port 22.
• The key was added but not accepted. On the Mac, run chmod go-w ~ ~/.ssh and try again. SSH refuses keys in folders that others can write to.
• The password is rejected. Use the short account name and the password you log in to the Mac with, not your Tailscale password.
• "This Mac uses Tailscale SSH". Run tailscale set --ssh=false on the Mac and turn on Remote Login.

Once the connection works, it is worth ten more minutes to tighten it: our post on running remote agents safely covers access rules, fingerprints and how to revoke a phone.

Ready to connect your Mac? Herdr Pocket is in a free public beta: join it on TestFlight and run Connect a Computer.