Shepherdr

Needs Herdr 0.8.0–0.8.2 running locally, herdr on PATH , and the same OS account as Herdr.

Download the archive for this machine from the latest release , plus shepherdr_0.1.1_checksums.txt .

On macOS, use shasum -a 256 -c - instead of sha256sum -c - . Put the binary on PATH if $HOME/.local/bin is not already there.

Start Herdr first. Shepherdr needs a stable private HTTPS address. Tailscale Serve is the usual way:

First start prints a setup link and QR code. They expire in ten minutes and are not reprinted on restart. Miss them? Stop Shepherdr and run shepherdr access invite . Open the link, name the device, choose Trust this device .

Open the same private address. Sign in with a passkey. http://127.0.0.1:8787 is only the local listen address.

Anyone who can reach Shepherdr has operator authority. The flag is not saved. Do not combine it with -public-origin or -session-lifetime .

Keep Shepherdr inside a network of people and devices you trust with the machine running Herdr.

One private HTTPS hostname, only for Shepherdr. Open only that exact address.

When sign-in is on, do not open Shepherdr by loopback, IP, localhost , another name, or another port.

Settings → Devices lists trusted sign-ins, invites another device, revokes one while another remains, or signs this browser out. A passkey can sync; copies share one entry and are revoked together.