Aria JIT Remote Access — Command Center

✅

LIVE — both laptops verified

Shipped: 2026-05-27

Coverage: MBA + MBP

Cost: $0 / month

🎯 Quick reference

When Aria needs the laptops

Aria SSHes via ssh mba or ssh mbp. First time in ~12h, you get a Tailscale auth URL — tap on iPhone, Face ID, done. One tap covers both laptops for the next 12h.

Panic button (real incident)

iPhone → Tailscale admin → Machines → m4max36gb → ⋯ → Remove. Aria loses ALL SSH access within 30 seconds. Recovery requires physical/screen-share access to M4 + ~2 min.

Aria's sudo password locations

MBA: 1Password item "Aria - MBA sudo"
MBP: 1Password item "Aria - MBP sudo"
Rotate quarterly

Check session lasts

~12 hours from the moment Topher taps the auth URL. After expiry, next SSH triggers fresh URL.

🗺 How the JIT flow works

   ┌──────────────────────────────────────────────────────────────────────┐
   │                          M4 Max (Aria's host)                         │
   │                                                                       │
   │  ssh mba "command"                                                    │
   │       │                                                               │
   │       ▼                                                               │
   │  ┌────────────────────────────────────────┐                           │
   │  │ Brew tailscaled (com.tailscale.tailscaled) │                      │
   │  │ - holds Tailscale identity (topher@gmail.com) │                   │
   │  │ - checks for valid check token                │                   │
   │  └─────────────┬──────────────────────────────┘                      │
   └────────────────│──────────────────────────────────────────────────────┘
                    │ negotiate via tailnet
                    ▼
   ┌────────────────────────────────────────────────────────────────────┐
   │  Tailscale coordination server                                      │
   │  - evaluates SSH rule: src=topher@gmail.com, dst=autogroup:self,    │
   │    users=[autogroup:nonroot, root], action=check                    │
   │  - if no valid check → returns auth URL to caller                   │
   │  - if valid → forwards SSH → MBA/MBP                                │
   └─────────┬─────────────────────────────────────────────────┬─────────┘
             │                                                 │
             │ (no valid check)                                │ (valid check)
             ▼                                                 ▼
   ┌────────────────────────┐                ┌────────────────────────────────┐
   │  Aria surfaces URL     │                │  MBA (or MBP) sshd             │
   │  to Topher in chat:    │                │  - authenticates as 'aria'     │
   │  "tap to approve"      │                │  - runs requested command       │
   └─────────┬──────────────┘                │  - sudo prompts for password    │
             │                                │    (from 1Password if needed)   │
             ▼                                │  - nuclear cmds blocked at      │
   ┌────────────────────────┐                │    /etc/sudoers.d/              │
   │  iPhone Safari opens    │                │    aria-deny-nuclear            │
   │  → Google sign-in       │                └────────────────────────────────┘
   │  → Face ID              │
   │  → check valid for 12h  │
   └────────────────────────┘

📋 Daily usage

🧑‍💻 Topher — When Aria needs to do something on a laptop

Aria attempts SSH from M4. First time per ~12h window, Tailscale prompts for re-auth.
Aria surfaces the auth URL in chat: "Need your approval — tap this on your phone."
Tap the URL on iPhone → Safari opens → Face ID through Google → approve.
Aria's next SSH attempt succeeds. All subsequent SSH for the next ~12h is silent.

~10 seconds when prompted; zero overhead otherwise

🤖 Aria — When asked to do laptop ops

Aria runs `ssh mba "command"` (or `ssh mbp "command"`) from M4.
If check is valid → command runs as `aria` user, returns output.
If check expired → SSH prints the auth URL → Aria surfaces it to Topher and waits.
For sudo work: Aria fetches the aria-on-MBA / aria-on-MBP password from 1Password, supplies via `sudo -S`.

Same session as ops conversation

⚙️ SSH config on M4

# === Aria JIT access (~/.ssh/config on M4) ===
# Gated by Tailscale SSH check mode + aria user with locked sudoers

Host mba topher-mba macbook-air
    HostName 100.103.172.103
    User aria

Host mbp jaime-mbp jaimes-macbook-pro
    HostName 100.105.54.125
    User aria

Stored at ~/.ssh/config (mode 600). If the tailnet IP of a laptop changes (re-enrollment), update the HostName line.

🛡 Security model — defense in depth

Network access

Control: Tailscale SSH `action: check`

Fails closed: If check token absent or expired, SSH attempt times out — no port-22 attack surface exposed

Identity verification

Control: Tailscale IdP flow (Google OAuth + Face ID on iPhone)

Fails closed: If Topher doesn't tap, no check token issued, no SSH succeeds

User isolation

Control: Dedicated `aria` user on each laptop (UID 502, standard with admin group)

Fails closed: Aria's actions never run as `topher`/`jaime`; `last | grep aria` shows clean session history

Privilege escalation

Control: sudo requires password (stored in 1Password; no NOPASSWD)

Fails closed: Non-interactive sudo fails outright; interactive sudo requires fetching from 1Password

Destructive command guard

Control: `/etc/sudoers.d/aria-deny-nuclear` blocks dd, diskutil eraseDisk, nvram, rm -rf /

Fails closed: Even with correct sudo password, these commands return "user aria is not allowed to execute"

🧪 Verification — all tests passed 2026-05-27

Test	MBA	MBP	Notes
First SSH triggers Tailscale check URL	✅	✅	Both laptops require fresh tap when no check token present
Subsequent SSH within window is silent	✅	✅	~12h check cached at the Tailscale coordination layer
One tap covers ALL owned devices	—	✅	MBP SSH worked without fresh tap — check keyed to source identity, not destination
sudo -n (no password) fails	✅	✅	"sudo: a password is required"
sudo + correct password + denied command blocked	✅	✅	"Sorry, user aria is not allowed to execute '/bin/dd...'"
sudo + correct password + allowed command succeeds	✅	✅	`sudo whoami` returns `root`
Panic button (Remove M4 in admin) cuts access in <30s	✅	—	`Operation timed out` returned on next SSH

🚨 Panic button — three severity levels

🔴 Real incident (M4 suspected compromised)

Action: iPhone → Tailscale admin → Machines → m4max36gb → ⋯ → Remove

Blast radius: All Aria SSH dies within 30s. Rest of tailnet (NAS, M3, your phone) unaffected.

Recovery: ~2 min (physical access to M4 to run `sudo tailscale up`)

🟡 Lighter (just want to end an Aria session)

Action: iPhone → Tailscale admin → Users → SSH sessions → revoke the check

Blast radius: Aria has to re-auth via URL flow on next SSH. M4 stays on tailnet.

Recovery: ~10 seconds (next time Aria SSHes, tap the URL)

🟢 Lightest (just wait)

Action: Do nothing — let the 12h check token expire naturally

Blast radius: Aria loses SSH at the 12h mark

Recovery: Next SSH after expiry triggers fresh URL

🔄 Recovery after panic button (Remove M4)

Topher: Confirm M4 is the actual problem (not the tailnet) — check Tailscale admin for "offline" status

Topher: Get physical/screen-share access to M4 (or use existing tailnet access from another device if not yet revoked)

Topher on M4: Run `sudo /opt/homebrew/bin/tailscale up` — Tailscale prints a fresh auth URL

Topher on iPhone: Tap the URL → Google sign-in → approve M4 rejoining the tailnet

Aria from M4: Run `ssh mba "uptime"` — verify SSH works again; tap URL once more for the fresh check session

Total recovery time: ~2 minutes. The check token from before the Remove may still be valid; if not, tap the URL once more during step 5.

🛠 Maintenance checklist

Cadence	Task	How
Quarterly	Rotate aria password on MBA	Generate new via `openssl rand -base64 24`. Update 1Password "Aria - MBA sudo". `sudo passwd aria` on MBA.
Quarterly	Rotate aria password on MBP	Same as MBA but on MBP. Update 1Password "Aria - MBP sudo".
Annually	Audit sudo log on both laptops	`log show --predicate 'process == "sudo"' --last 365d \| grep aria` — should show only legitimate Aria ops sessions
On macOS upgrade	Verify Tailscale SSH still works	After major macOS version bump (e.g., 26→27), run `ssh mba "whoami"` — confirm still returns `aria`. macOS sometimes resets sshd-related state.
On Tailscale upgrade	Verify `tailscale up --ssh` setting still active on laptops	On each laptop: `tailscale debug prefs \| grep -i ssh` — should show `RunSSH: true`. If not: `sudo tailscale up --ssh`.
Any time M4 is rebuilt	Re-add SSH config aliases	Restore `~/.ssh/config` entries for mba, topher-mba, macbook-air, mbp, jaime-mbp, jaimes-macbook-pro. (Snippet in OPS-81 + this runbook.)

🐛 Known quirks + workarounds

macOS overwrites /etc/ssh/sshd_config on system updates

Impact: If we ever add custom sshd_config (we currently don't — Tailscale SSH replaces it), it would need re-fixing after each macOS update

Workaround: We use Tailscale's built-in SSH server, not macOS sshd, so this doesn't affect us today. If we ever add custom sshd_config: use `chflags simmutable` to make file immutable

tailscale ssh wrapper has DNS resolution issues on M4 post-brew-migration

Impact: Cannot use `tailscale ssh aria@hostname` from M4; plain `ssh` works fine

Workaround: SSH config aliases (`ssh mba` / `ssh mbp`) at `~/.ssh/config` on M4 resolve to IPs directly

App Store Tailscale daemons cannot be killed on M4 post brew-migration

Impact: NetworkExtension remnants visible in `launchctl list` (SIP-protected, cannot bootout)

Workaround: Cosmetic only — brew daemon `com.tailscale.tailscaled` owns the actual tailnet; the remnants are idle. Will clean up on next macOS upgrade.

Device re-enrollment creates new tailnet IPs

Impact: If a laptop is "Removed" then re-added, it gets a new tailnet IP. SSH aliases on M4 must be updated.

Workaround: Update `~/.ssh/config` on M4: change `HostName` line. Get new IP via `tailscale status | grep <device-name>`.

Open bug tailscale/tailscale#16541

Impact: Check mode "keeps asking for auth even after first auth" — rare, intermittent

Workaround: If it bites, just re-tap. If it bites repeatedly, raise checkPeriod from default (12h) by adding an explicit `checkPeriod: "24h"` to a user-identity-sourced SSH rule

📐 Architecture decisions (rejected → chosen)

❌ REJECTED: Tailscale Premium with custom posture attributes

$216/yr for a few API calls per week. Outsized cost for utility.

❌ REJECTED: Tailscale tag-toggle + launchd polling timer on M4

Topher allergic to ops dependencies that need monitoring; polling cron has resource overhead even at small scale

❌ REJECTED: Cloudflare Worker as toggle/timer

Over-engineered — adds CF Worker maintenance to "use what you have" promise

❌ REJECTED: SSH certificates signed on iPhone (a-Shell, etc.)

Research showed iOS terminal apps don't reliably support cert-signing; would be original engineering

❌ REJECTED: Cloudflare Access for Infrastructure (per-session push)

Daemon on each laptop + push fatigue after months of use

✅ CHOSEN: Tailscale SSH check mode (shipped policy default)

Free, zero new code, zero new infra, zero new vendor surface. Native expiry via wall-clock cryptographic check at connect time. The primitive was sitting in the default policy the whole time.

Full decision trail with research links: OPS-81

🧹 Cleanup task — revoke unused OAuth client

During the architecture iteration, an OAuth client (k91gcK6tdL11CNTRL) was generated, never used, and removed from ~/.aria-secrets. Best practice is to also revoke it in Tailscale admin.

Open https://login.tailscale.com/admin/settings/oauth
Find the client with ID k91gcK6tdL11CNTRL (description: "Aria JIT access (M4)")
Click the ⋯ menu next to it → Revoke (or Delete depending on UI version)
Confirm

🔮 Future work (none urgent)

Persistent NAS auto-mount on both laptops — the actual reason this access was built. Solves the "we keep losing the NAS connection" problem permanently. Pending research + implementation.
Test panic-button recovery flow on brew tailscale — verify that `sudo tailscale up` from CLI prints fresh URL after a logout. Low priority — architecture is sound, just want one tabletop confirmation.
Fix MagicDNS quirk on M4 — `tailscale ssh aria@hostname` doesn't resolve post-brew-migration. Workaround (SSH config aliases) works fine. Low priority.
Upgrade to request-approve flow (Pushcut/ntfy webhook) — if "Topher has to remember to tap first" becomes annoying, add a Pushcut intermediary that lets Aria proactively request access. Decided to defer until we have ~4 weeks of usage data.

📎 Related

Linear OPS-81 — full architecture iteration trail (5 architectures considered, decision log)
Session journal: memory/sessions/aria/2026-05-27-aria-jit-access.md
Reference memory (daily usage): memory/reference_aria_jit_ssh_access.md
Feedback memory (architectural gotcha): memory/feedback_tailscale_check_mode_no_tags.md
Tailscale SSH official docs — including `checkPeriod` reference
Tailscale blog: Frequent reauth doesn't make you more secure — design rationale for event-driven re-auth (vs polling)