@notaharness/beam

Passkey-controlled access to your machines

Beam connects your machines using Tailscale’s tailcat library. Your passkey approves which machines can connect. Your data is encrypted between machines through a tailcat tunnel.

Read the docsGitHub
Powered byTailscaleTailscale
Your laptop reaches your machines over WireGuardA laptop connects directly to a build box and a home server. The workstation can't be reached directly, so the connection goes through a Tailscale relay. Output from a session on the workstation flows back through the relay to the laptop's screen.

Getting started

  1. Passkeylaptop

    1.Create a fleet

    On your first machine, create a passkey, then approve that machine. Follow the browser prompts or scan the QR with your phone.

    beam init --label laptop
  2. laptopmac-mini-homelinux-desktop

    2.Enrol more machines

    Join each machine with the same passkey. Compare its fleet fingerprint with beam status on your first machine.

    # On mac-mini-home
beam join --label mac-mini-home

# On linux-desktop
beam join --label linux-desktop
  3. laptopmac-mini-homeRemote shell

    3.Open a shell

    From your laptop, open a shell on mac-mini-home. Keep Beam running on both machines.

    beam connect mac-mini-home

Install Beam

$ npm install -g @notaharness/beam

Beam is a Go binary for macOS and Linux. n10 includes it in the Fleet section to run agents on your other machines.

Read the docsReport an issue

How a machine connects

Use your passkey to approve each machine you add to your fleet. Removing a machine also needs your approval.

Each approval covers one change. A machine already in the fleet cannot add another machine on its own.

Membership details
Passkeybeam.n10.isMachineSigning keyApproval pageNode keyEach approval covers one change

Directory and approval page

Our Cloudflare worker stores only encrypted data. Your data never reaches us unencrypted and can only be read by you when unlocked with your passkey in your browser on your computer or phone.

Approval pageReceives PRF outputMachineWorkerEncrypted records

Connecting through Tailscale

Tailscale’s tailcat library connects your machines directly peer-to-peer when possible. Tailscale’s relays provide a fallback when a direct connection is unavailable. You do not need to set up a VPN or open ports. Beam configures the tunnels.

Tailscale relayMachine AMachine BFallbackDirect