GET STARTED

Quick start

This guide connects two machines. You need a private Git repository for the sync data, such as an empty repository on GitHub. Install Tether on both machines first.

1. Set up the first machine

tether init

Tether asks for the repository URL and for a passphrase. The passphrase protects the encryption key of your dotfiles. You need it on each machine, so keep it safe.

tether init runs the first sync and installs the background daemon, which syncs every 5 minutes. To skip the daemon, add --no-daemon.

tether status

tether status shows the daemon, this machine's profile and the synced files.

2. Add a second machine

tether init --repo git@github.com:you/dotfiles.git

Use the same repository and enter the same passphrase. Tether applies your dotfiles. Your packages do not install yet: the new machine does not trust the first machine.

In a terminal, the sync asks "Install these packages?". Choose Decide later. You trust the machine in the next step, and its packages then install without a question.

3. Trust each machine

Each machine signs a record of its packages with its own key. A machine installs synced packages on its own only from machines whose key it trusts. Trust works in each direction, so do this on both machines.

On each machine, read its id and its full key fingerprint:

tether machines show

On the other machine, trust it with the fingerprint you read:

tether machines trust <id> --fingerprint SHA256:...

Read the fingerprint on the machine itself. Do not copy it from the sync repo. Tether trusts the key only when the fingerprint matches. See Machine trust.

With more machines, trust a new machine on all of them from one machine that they already trust:

tether machines trust <id> --fingerprint SHA256:... --on all

4. Sync and review the Inbox

tether sync
tether packages inbox

The sync installs the packages that the trusted machine lists, when they pass the package checks. A package that fails a check waits in the Inbox with its reason. For example, a formula from a tap outside your trusted taps waits as "untrusted tap". The Inbox reasons list every reason.

Approve or reject each item:

tether packages approve <manager:name>
tether packages reject <manager:name>

You can also use the dashboard: run tether and open the Security tab. See The Inbox.

Next

• Give machines different packages: Profiles and Keep servers clean
• Trust a Homebrew tap: Homebrew taps
• On Linux: Linux and systemd