# 12. Network, mesh, sync, and backup Alloy assumes the machine is disposable and your state is not. An install should be rejoinable: build the medium, install, sign in to two things, and your files and your other machines are there. Both enrollments are opt-in. Nothing connects to anything until you say so. ## Wifi and wired networking alloy net lists interfaces and connections. Connecting, disconnecting, and toggling the wifi radio all work without any privilege, because NetworkManager grants those to an active session. Joining a network you have never joined before is a different permission, and the console does not yet ask for it. For a new network: run0 nmcli device wifi connect "Network Name" --ask Once it is saved, `alloy net` connects to it like any other. ## The firewall Alloy runs firewalld, on every install and both profiles. Inbound connections are refused unless something allows them; outbound traffic is untouched. What is allowed by default on a desktop install is `ssh`, mDNS, and DHCPv6 replies. That is the same list as the services Alloy actually runs, which is the point: the firewall is the enforcement of the defaults rather than a separate policy to keep in step with them. Printing needs nothing here. CUPS listens on a unix socket and on localhost, and loopback is not filtered. To open something you installed yourself: run0 firewall-cmd --permanent --add-port=8080/tcp run0 firewall-cmd --reload `--add-service=` takes a name from `firewall-cmd --get-services` and is better when one exists, because it carries every port the service needs. To see what is currently allowed: firewall-cmd --list-all **A server image is stricter by one entry.** It allows `ssh` and DHCPv6 and not mDNS, because that profile is also what runs on a machine with a public address, and answering mDNS to the internet buys nothing. If your server is on a LAN and you want to reach it at `.local`: run0 firewall-cmd --permanent --add-service=mdns run0 firewall-cmd --reload Without it the machine is still findable: it sends its hostname over DHCP, so it appears in the router's lease table under the name it was minted with. **The tailnet is exempt.** The `tailscale0` interface is in firewalld's trusted zone, so anything reaching this machine over Tailscale is accepted on any port regardless of the rules above. That is deliberate, and it is worth knowing rather than discovering: a service you start for yourself is reachable by every machine on your tailnet, without opening a port. Access there is controlled by your Tailscale ACL rather than by this firewall. ## Mesh: Tailscale alloy mesh A machine that has not joined anything shows an offer rather than an empty list. Press `e` to set the control server before signing in: leave it empty for tailscale.com, or enter a URL for a self-hosted Headscale. Signing in escalates to root and then waits on a browser login, so the console gets out of the way while that happens and comes back into the peer list afterwards. Once enrolled, the view lists your peers, whether each is online, when it was last seen, and lets you pick or clear an exit node. This machine is listed first. If you are on a self-hosted control plane, the title says so. Anything that acts on the whole tailnet rather than on this machine — deleting a node, editing the ACL, minting an auth key — lives in the admin console and nowhere else. The `tailscale` client has no verb for any of it. `w` opens that console in a browser. On a self-hosted control plane the address is a guess at the control host's root, and the status line says so, because Headscale serves the control API there and no UI. The plain command is `run0 tailscale up`, and `alloy tail` is kept as an alias for the verb. Alloy does not ship a Headscale server. That is fleet-admin work, not client-OS work. ## File sync: Syncthing alloy sync Three tabs: **folders**, **devices**, and **pending**. - Folders shows each synchronized folder's path, share mode, and whether it is paused. `a` adds one, `d` removes one, and both confirms tell you what is *not* deleted, because "remove folder" must never read as "delete my documents". `s` opens the folder's share list, where each device toggles on or off as you press it; this machine is not offered there, because taking it off the list is what `d` does. - Devices shows connection state, this machine first. - Pending lists devices that have added you and are knocking. Accepting one finishes the pairing. Enrollment is a user service and needs no root: systemctl --user enable --now syncthing.service Syncing over the LAN also needs the firewall opened, because Syncthing is off by default and Alloy does not open ports for services nobody is running: run0 firewall-cmd --permanent --add-service=syncthing run0 firewall-cmd --reload Two machines on the same tailnet need none of that. The tailnet is exempt from the firewall, so they find each other with no rule at all. One asymmetry to know about: you can accept a pending device but not decline it. The command-line client Syncthing ships has no verb for dropping a pending entry, so an unaccepted device stays listed. The view says so when you press `d` there. Syncthing's own web UI is still at `127.0.0.1:8384` for anything the console does not cover — ignore patterns, versioning, per-folder advanced settings. `w` opens it rather than making you remember the address. ## Backup: restic restic is in the image and Alloy prescribes no policy. Where you back up to is answerable only by you, so there is no default repository, schedule, or retention. This matters more than it looks. Sync is mesh plus latest-wins; it gets your files onto the new machine. It does not get back the file you deleted three weeks ago and only just noticed. That case needs versioned backup, which means configuring restic: restic init --repo restic backup ~/Documents ~/Pictures restic snapshots Any of restic's backends work: local disk, SFTP, S3, B2, rclone. A systemd user timer is the usual way to make it recurring. There is no `alloy backup` view. It is a candidate, not a plan. ## What is deliberately not synced - **Secrets.** Too personal, and the security models vary too much for a defensible default. gopass (chapter 10) is the shipped tool, and you decide what it holds and where it goes. - **Dotfiles.** Syncthing can carry `~/.config` and Alloy does not set that up for you. - **The first-boot marker.** Deliberately never replicated: a synced copy would suppress the enrollment screen on the next machine you set up, which is exactly the machine that needs it.