Set up a headless Mac
A Mac with nobody at it logs in by itself, so eris comes back after restarts.
- Turn on Remote Login in System Settings.
- From the account eris should use, tick Headless setup, run the command, then restart: it logs in and starts eris.
- FileVault stops automatic login. Turning it off (
sudo fdesetup disable) leaves a stolen Mac's disk readable. Or keep it: log in with Screen Sharing now, and after each restart, unlock it with SSH first. - From elsewhere, use Tailscale.
- Optionally,
--user erisgives eris a standard account of its own, without admin rights, so yours stays clean to recover from. It doesn't protect eris's own history and keys. - Give eris scoped keys and tokens of its own.