Triggering macOS Operations Remotely

We have long been able to trigger processes on remote computers. It is what the World Wide Web is built on for example, and how we login to hugely powerful physical and now virtual devices, to carry out operations. We can also do the same with macOS. I’ve done it in so many ways in the past for my personal setup. Using Hazel and Dropbox to trigger commands via file sync, using browser bookmarks and Keyboard Maestro remote triggers, using remote screen sharing apps like Screens, and even via a home network VPN and connecting at the command line.

Those are all still options, but in this post I am going to set out a way that I think is easy to set up and use, such that you will be able to trigger any number of things on your Mac right from your iPhone (or iPad).

Security

The first thing to highlight is that at all points when you are interacting with a device remotely, you want to do everything you reasonably can to ensure it is secure. Now if you are the CEO of a large tech company, a megastar in the cyber security space, a famous politician, investigative reporter, etc. your level of security is probably such that you will want to avoid doing this in most cases. It is hard to stop large threat actors and those who really want to get in. You just need to be running at a deeper level of op-sec. For the rest of us, there should be enough information in what I set out here.

Starting Local

Fundamentally, we are going to use Apple Shortcuts and a secure shell (SSH) connection to allow our iPhone to communicate with our Mac. To start out, we want to be on the same network and we want to configure Shortcuts to be able to use an SSH connection without getting you to type in your password every time.

While we could potentially store our password in an app such as Data Jar, there is a better way. SSH can be configured to use cryptographic keys which is how we will tackle this. But, rather than explaining it here, I can just reference you back to a post I wrote back in 2020 that steps you through exactly how to do this.

All you need to know is the name of your Mac, and a basic understanding of Shortcuts and how to open the Terminal, and you should be good to go.

• Instructions: Setting up SSH for Shortcuts

Remote Access Infrastructure

Next comes the magic sauce that I think is the thing that makes everything so much more achievable whilst maintaining security. When you are away from your home network, to be able to connect to your Mac, you have a few options.

1. You could open up a port in your firewall so you can access the Mac directly. You would probably want to change your SSH port from the default 22 (port forwarding in your gateway router), disable password login for SSH, and potentially set up port knocking if your hardware supports it. You have to be very careful with this to do it with any level of security.
2. You could set up a secure connection so your iPhone could tunnel back to your network and see it just as though it was directly connected. This is similar to 1, but now you are creating a virtual private network (VPN) on your network and allowing that to show up on the Internet. Again more firewall port changes, and this time you need to run a server for the VPN.
3. You might be able to find some software to relay your connection. There are lots of screen sharing utilities that allow you to traverse the firewall and instead you connect to a server that your Mac has a pre-established point-to-point connection with, and you tunnel your comms via that server.

I am sure there are more options, but there is one in particular that I want to recommend that takes elements of 2 and 3, and combines them in an exciting way.

Tailscale is a software-defined VPN. Rather than running a VPN server, you install the Tailscale software on each device and they build a secure mesh between one another. So rather than going back to a VPN server, each device can reach out directly to another. There is a secure registration and distribution of info from a central coordination server out to existing nodes when a new node comes online, but then that info is cached locally, and the nodes communicate directly and independently.

Sounds too good to be true, so there must be a catch. The price … is not it. Tailscale has increased their personal tier from including 10 devices, to 100, and now unlimited. Tailscale, I think, are doing very well in the business space, and if you think about it, the overheads for just connecting devices is minimal for them. They do have other services built on top, but this free, secure, connectivity is phenomenal, and if you don’t already have it installed on your devices, well now is the time to do just that — you will need it next!

Connection Shortcut

I do not always have my Tailscale connection enabled on my iPhone. Most of the time I do, but not all the time. Therefore for any shortcuts where I want to connect back to a device on my Tailnet network, I want to check if I am connected, and if not, connect.

Fortunately, Tailscale is a first class Apple Shortcuts citizen, and it is relatively simple to put together a shortcut to connect me and ensure this is called at the start of any shortcuts requiring Tailnet to be connected.

• Download Shortcut: Connect to Tailscale

Now we can build a simple shortcut to illustrate how this works.

First Connection

To connect to my devices I like to use their Tailscale magic DNS name. This is a bit more meaningful and friendly than the IP address. If you want to get the Magic DNS name, you can either copy it from the Tailscale app, or run this shortcut I created.

• Download Shortcut: Get Tailscale Magic DNS Entry

Once you have an identifier for your Mac, we can build a new two step shortcut. First we call the Tailscale connection shortcut created earlier. Then we use an SSH action, configured (in my case) with the magic DNS entry for the Mac, the standard SSH port number (22), my username, and my SSH key.

The command I’ve put into the SSH action is one that will tell me how much free space I have left on my Mac at the moment.

• Download Shortcut: Remote Example 1

When the shortcut runs, it ensures Tailscale is connected, authenticates to the Mac using the provided SSH keys, runs the command, receives the output, and displays it to me.

You can do a variety of things from the command line, particularly if you utilise the open command (for running applications and opening URLs), or the command line interface (CLI) options that comes with many applications.

Enhancements

There are a couple of enhancements to this basic approach that I have found useful and would like to suggest as ways to build out your own setup.

Future-Proofing Devices

Over time we probably all change our devices. Maybe we upgrade. Maybe a device fails and we need to replace it. Maybe we offload onto a second hand device. At these points we install Tailscale, name the device, join it onto our Tailnet, and start using it. However, if we have lots of shortcuts calling out to a device and it is replaced, then we have to go around replacing lots of magic DNS entries.

My recommendation is to use Data Jar and set up aliases for sets of functionality rather than device.

For example if I have operations I use on my home office Mac remotely that relate to the Mac itself, to managing the local LLM I have running on it, for running a set of website operations, and for managing my media (e.g. running Plex), I might reasonably split some of these off in the future, so I might create entries of “Home”, “AI”, “Web Ops”, and “Media”. Each of these would start out holding the magic DNS entry for my home office Mac, but over time some may switch to a Mac mini server I set up, or a non-Apple NAS (supporting SSH) that is running a media server, and probably at some point a new home office Mac. As each set of functionality moves to a different device, I just update the associated magic DNS entry.

I have blurred out some of the more sensitive data, but I created a Dictionary object in Data Jar, and then just added what are effectively meaningful aliases. These aliases collectively point to just a handful of devices.

The basic structure from before then just expands to include the retrieval and use of the value from Data Jar, so here I run a command I’ve defined to start an AI dashboard in a tmux session.

Multiple Options

The next step for me is to start to break this out. Rather than one shortcut per activity being presented, I generally prefer the approach of displaying one shortcut-based menu system whereby I can filter down to what I want. But that is not to say you can’t have the best of both options. For example if you have something you run frequently, perhaps you do want that separate. If you have multiple shortcuts menu systems, maybe some functionality would be best to be present in both.

There are a few approaches you might take for this.

The first is simply to place all of your remote operation shortcuts into their own folder in Apple Shortcuts, and then allow the user to choose which of those shortcuts to run.

This approach gives you a simple linear list, and no real administration to speak of other than to ensure you have all your remote operation shortcuts in the right place, and that you perhaps use a decent naming convention to help you keep your options organised.

If you want more fine-grained control, then you can build your own menu in Shortcuts. Using the Choose from menu action, you can build a nested set of menus that will ultimately call a specific shortcut.

This gives you a high level of control — with the option to name, order, and arrange everything in any hierarchical structure you like. However, that brings with it the overhead of maintaining that. If you are not adding operations regularly, then this could be a good option: an initial outlay of effort, and then minimal maintenance thereafter.

If that still doesn’t quite scratch your itch and you want even more fine-grained control, then you can get quite fancy with Menu Box for Shortcuts, a helper application for Apple Shortcuts that lets you create more visually appealing lists in Shortcuts. You might do this via visually built sets in the Menu Box, or via a set of text definitions and dynamic generations as illustrated here.

Conclusion

There is nothing revolutionary here — but the combination of Tailscale, Shortcuts, and SSH is certainly evolutionary. It makes remote control access simpler and safer implement, by using a simple and scalable interface on your mobile device, or even from another Mac should you so wish.

The only question now is what will you automate using this?