Skip to main content

max / alloy

Call it a private network, not a network identity Reported from a first boot: the first-boot row read as an account or a login rather than as a network the machine joins. 'private network' is what Tailscale is in plain words, pairs with 'file sync' as a noun phrase of the same shape, and agrees with the promise beside it instead of pulling against it.
Author: Max Johnson <me@maxj.phd> · 2026-09-03 22:54 UTC
Signed with PGP, not checked
Commit: 04eb110210903d2be435aad3c171c5d72df8f04a
Parent: 6e7fa8b
4 files changed, +14 insertions, -8 deletions
M docs/CONTINUITY.md +3 -3
@@ -6,7 +6,7 @@
6 6
7 7 ## Thesis
8 8
9 - The machine is disposable. The state is not. What survives a reinstall or a hardware upgrade should not depend on the user remembering to copy files, re-establish keys, or reconfigure a mesh. Alloy ships the two adopted tools that make that true (network identity and file synchronization) as base-image citizens, gated behind an explicit enrollment gesture and controlled through the Alloy Console.
9 + The machine is disposable. The state is not. What survives a reinstall or a hardware upgrade should not depend on the user remembering to copy files, re-establish keys, or reconfigure a mesh. Alloy ships the two adopted tools that make that true (a private network and file synchronization) as base-image citizens, gated behind an explicit enrollment gesture and controlled through the Alloy Console.
10 10
11 11 Everything in this document is a curated adoption of existing tools. Alloy authors nothing in this space. The Alloy contribution is: the tools are present at first boot, they enroll in one screen, and they are controlled through the same design-system surface as everything else.
12 12
@@ -44,7 +44,7 @@
44 44 | first boot |
45 45 | two enrollments make this machine rejoinable. both are optional. |
46 46 | |
47 - | > network identity not enrolled reach your other machines from anywhere |
47 + | > private network not enrolled reach your other machines from anywhere |
48 48 | file sync not enrolled your files follow you onto this machine |
49 49 | |
50 50 | q when you are done. skipping is fine: alloy mesh and alloy sync enroll later.|
@@ -95,7 +95,7 @@
95 95
96 96 **Shipped in the base image. No default policy.** Alloy provides the tool; the user provides the folders, schedule, retention, and destination. Sync (Tailscale, Syncthing) has defensible defaults because enroll-and-it-works is the whole model; backup does not: "where do you back up to" is answerable only per-user.
97 97
98 - The forcing observation: when a user's laptop dies, they have their sync mesh (Syncthing pulled files back) and their network identity (Tailscale re-enrolls). What they don't have without configuring restic is *point-in-time recovery*, the "I deleted this file three weeks ago and just noticed" case that only versioned backup solves.
98 + The forcing observation: when a user's laptop dies, they have their sync mesh (Syncthing pulled files back) and their private network (Tailscale re-enrolls). What they don't have without configuring restic is *point-in-time recovery*, the "I deleted this file three weeks ago and just noticed" case that only versioned backup solves.
99 99
100 100 **rustic, and why not yet.** rustic is a Rust reimplementation of restic that reads and writes the same repository format, which makes it the one place in the image where a competitive Rust option exists against an adopted Go tool. Principle 1 says that comparison gets made rather than skipped. Three things decide it for restic today, and none of them are about the code:
101 101
M docs/manual/04-first-fifteen-minutes.md +1 -1
@@ -12,7 +12,7 @@
12 12 The first time you log in, a terminal opens on `alloy setup`. It offers two
13 13 enrollments, both optional:
14 14
15 - - **Network identity** (Tailscale), so this machine can reach your others.
15 + - **Private network** (Tailscale), so this machine can reach your others.
16 16 - **File sync** (Syncthing), so your files follow you onto this machine.
17 17
18 18 Skipping is fine and reversible. `alloy mesh` and `alloy sync` do the same
M crates/alloy/src/main.rs +1 -1
@@ -242,7 +242,7 @@
242 242 #[command(subcommand)]
243 243 surface: Option<SyncSurface>,
244 244 },
245 - /// The first-boot offer: network identity and file sync
245 + /// The first-boot offer: a private network and file sync
246 246 Setup {
247 247 /// Do nothing if this machine has been offered the screen already.
248 248 ///
M crates/alloy/src/setup.rs +9 -3
@@ -81,8 +81,8 @@
81 81
82 82 /// The two rows, in the order CONTINUITY.md draws them.
83 83 ///
84 - /// Network identity first because it is the one that can need a browser, and a
85 - /// user who is going to be sent to one is better sent early than after they
84 + /// The private network first because it is the one that can need a browser, and
85 + /// a user who is going to be sent to one is better sent early than after they
86 86 /// have decided the screen is finished with them.
87 87 const ROWS: [Row; 2] = [Row::Mesh, Row::Sync];
88 88
@@ -102,7 +102,13 @@
102 102 /// concealed; they are just not the first word.
103 103 const fn label(self) -> &'static str {
104 104 match self {
105 - Row::Mesh => "network identity",
105 + // "network identity" until 2026-09-03, and it was read as an
106 + // account or a login rather than as a network the machine joins —
107 + // reported from a real first boot. "private network" is what
108 + // Tailscale is in plain words, it pairs with "file sync" as a noun
109 + // phrase of the same shape, and it agrees with the promise beside
110 + // it instead of pulling against it.
111 + Row::Mesh => "private network",
106 112 Row::Sync => "file sync",
107 113 }
108 114 }