Private mesh

Reach your own machines.

Kith is the name of this product. A company installs it on their server. The picture, the click, and the keyboard stay on their Mac.

kith.sachin-ai.cloud

Their server

Coordination is HTTPS on their domain. Headscale stays on loopback. The internet never sees the control port.

SSH and Screen Sharing are WireGuard between enrolled machines. The server cannot read the Mac password.

The mesh allow-list is the owner user. A desk code is a local check, not the lock.

How it works

Screen and SSH MacBook or phone to the desk Mac, sealed. On the same Wi-Fi the packets go direct. Away from home they try direct, then relay through the company’s own DERP. The relay cannot open the payload.
Login and names The Tailscale app logs into https://mesh.<their-domain>. That request ends at their reverse proxy and is forwarded to Headscale on 127.0.0.1:8080.
The picture Screens 5 or Jump Desktop opens vnc://<desk-host>.mesh.ts.net. Kith Mesh Desk only issues a pair ticket on the tailnet address. It does not draw the screen.

Features

Own control planeHeadscale on their server. Not Tailscale Inc.
Stable namesMagicDNS inside the mesh. A public IP cannot be the control name.
PhoneApp Store Tailscale, then Screens 5 or Jump Desktop. A preauth key cannot be pasted into the phone app.
Desk appsElectron and Swift read kit/company.env. They do not fall back to another company’s host.
Closed portsPublic screen sharing stays unpublished. UDP 3478 is path finding only.
Install filenode kit/render.js kit/company.env kit/out writes their server file.

Install

Copy kit/company.example.env to kit/company.env.
Fill domain, public IP, owner, desk host, and a 4 to 8 digit desk code.
Render with node kit/render.js kit/company.env kit/out.
Install Headscale from that file. Leave 8080 on loopback. Open only UDP 3478.
Enroll the owner’s machines. Open Mesh Desk only after kit/company.env exists.

This page is the product site. It does not open a remote desktop and it does not enroll a machine.