SSH access to your machine

You reach your machine over SSH as root, with keys only: there is no password login. The connection runs over Tailscale, a private network: your machine has no public IP address, and only Tailscale accounts it's shared with can reach it. This guide covers the key, Tailscale, connecting, and removing access later.

Create an SSH key

Your key comes in two halves: a private key that never leaves your computer, and a public key (one line of text) that you give us. We accept OpenSSH public keys of type ssh-ed25519, ecdsa-sha2-*, ssh-rsa, and hardware security keys (sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com). Ed25519 is a good default.

macOS and Linux

Open a terminal and run:

ssh-keygen -t ed25519 -C "you@laptop"

Press Enter to accept the default file (~/.ssh/id_ed25519) and choose a passphrase. Then print the public key:

cat ~/.ssh/id_ed25519.pub

Windows

Windows 10 and 11 include the OpenSSH client. In PowerShell, run:

ssh-keygen -t ed25519 -C "you@laptop"
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

Hardware security keys

With a FIDO2 security key plugged in, ssh-keygen -t ed25519-sk creates a key that only works while the device is present.

Add your key to your account

1. Copy the whole public key line, from the key type to the comment at the end.
2. Open your account and add it to your SSH keys. Add one key per person or computer that needs access, so you can remove one later without affecting the others.
3. Keys are installed for root when we rack your machine. You can also enter keys in a pre-order's rack configuration; those are installed on that order's machines.

Set up Tailscale

Your machine is on NiceRack's private tailnet, which we also use to monitor it. We share it with your Tailscale account, and you reach it from any computer running Tailscale while signed in to that account.

Create a Tailscale account

Sign up at tailscale.com with Google, Microsoft, GitHub, Apple or another identity provider. The free Personal plan is enough to reach your machines. If you already use Tailscale, use your existing account.

Install Tailscale on your computer

Download Tailscale for macOS, Windows or Linux from tailscale.com/download and sign in with the same account. On Linux:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Accept the shared machine

1. Open the machine in My hardware and open its Tailscale invite link.
2. Sign in with your Tailscale account if asked, and accept the share.
3. The machine now appears in your Tailscale machine list, and in tailscale status on your computer.

Each invite is for one Tailscale account, and an invite that isn't accepted expires after 30 days; if yours has expired, ask us for a new one. Tailscale's guide to sharing machines explains how shares work.

Connect

Use the machine's full Tailscale name from My hardware, ending in .ts.net. For a shared machine, the short name on its own doesn't resolve.

ssh root@<tailscale-name>

The first time, SSH shows the host key's fingerprint and asks whether to continue. Type yes and SSH remembers the machine. If SSH later warns that the host key has changed and the machine hasn't been reimaged, don't log in: write to us.

If you use a key file other than the default, add -i ~/.ssh/<key-file>. If the name doesn't resolve, check that Tailscale is running and signed in to the account you accepted the share with, and that MagicDNS is on.

Save it in ~/.ssh/config

An entry in ~/.ssh/config saves typing the full name and user every time:

Host spark-1
    HostName spark-1.example.ts.net
    User root
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Replace the HostName with your machine's Tailscale name. Now ssh spark-1 connects, and so do tools that use SSH, such as scp, rsync, VS Code Remote-SSH and git. Add one Host block per machine.

Copy files

scp ./model.gguf root@<tailscale-name>:/root/
rsync -avz ./data/ root@<tailscale-name>:/root/data/

With a ~/.ssh/config entry, scp ./model.gguf spark-1:/root/ is enough.

Reach a service on the machine

Over Tailscale, your devices can reach any port the machine listens on, and nobody else can. For a service you only want on the machine itself, keep it on localhost and forward it through SSH. This forwards port 8000 on your computer to port 8000 on the machine:

ssh -L 8000:localhost:8000 root@<tailscale-name>

While it runs, http://localhost:8000 on your computer reaches the service.

Your own tailnet and Tailscale SSH

The share is the simplest setup. If you'd rather have the machine in your own tailnet, under your own access rules, or use Tailscale SSH instead of SSH keys, write to us. Both change how the machine joins our tailnet, so we set them up with you.

Rotate keys and remove access

The keys on your account are installed when we rack your machine. After that, the machine's /root/.ssh/authorized_keys file is yours to manage. To replace a key:

1. Create the new key and add its public key to the machine: ssh-copy-id -i ~/.ssh/<new-key>.pub root@<tailscale-name>, or append the line to /root/.ssh/authorized_keys.
2. In a new terminal, check that you can log in with the new key. Keep your current session open until you have.
3. Delete the old key's line from /root/.ssh/authorized_keys.
4. Update your account too: remove the old key and add the new one, so your account always lists the keys you use.

Remove someone's access

Reaching the machine takes both a Tailscale share and an SSH key, so remove both:

• delete their key's line from /root/.ssh/authorized_keys on every machine, and remove it from your account;
• if they accepted a share with their own Tailscale account, write to us and we'll revoke it. After that, their Tailscale account can no longer reach the machine.

If you're locked out

If you've lost every key that works, or a change to SSH, the firewall or Tailscale stops you connecting, write to contact@nicerack.cloud from the email address on your account. Include:

• the machine's hostname and serial number, both shown in My hardware;
• the new public key you want to use;
• what changed before you lost access.

We'll tell you the options for your machine. Some of them, such as a reimage, erase its disk, so keep backups of anything you can't lose.