Everything it wrote
The audit — every file the install put outside a home directory, what it never touches, and the handful of things a Mac does differently. For whoever answers for the box.
What the install does is the walkthrough, in the
order it happens. This is the other question, the one asked by whoever is
responsible for the machine: what is on it now, and what did it touch.
Outside a home directory, on Linux
Four things, and there is no fifth:
- The service unit — the
systemd unit that runs the panel on
127.0.0.1.
/swapfile, and the two lines of configuration that go with it: an entry
in /etc/fstab so it survives a reboot, and
/etc/sysctl.d/60-beafk-memory.conf.- The packages those steps named — Tailscale, from Tailscale's own signed
repository, and whatever the agents you picked need.
- The agent account itself, and its home.
Everything else lives under ~/.beafk and that account's own home.
What it never does
- No changes to your firewall. No port is opened, no rule is added. The
service listens on loopback and reaches your phone over
your own network.
- No packages beyond what those steps need.
- Nothing phones home except the machine's own five-minute report to the
cabinet, and an hourly timer that checks for a new build. That is the whole of
its outbound traffic to us.
- Nothing reads your repositories. The install has no interest in them and
neither has the cabinet — see
what beafk can see.
Hardening, which is yours to run
The install does not close public ssh or turn a firewall on. That is a
decision about a machine you own.
On a Mac
Same install, same panel, same agents. The walkthrough says what each step does
differently at the moment it does it — no account to make, no swapfile, no
virtual screen, and Tailscale looked for rather than installed. What is left:
- beafk runs as you, while you are logged in. There is no service account
and no daemon in
/Library — two launch agents in your own
~/Library/LaunchAgents, one for the panel and one for the hourly update.
Log out and the machine stops answering, because the thing serving the
panel goes with your session.
- Tailscale is an app, not a daemon we put here. The install only looks
for it. If it is missing, the connect screen after the walk mints
Get Tailscale on the App Store
(Homebrew is under a fold on that same card). Sign in to the account that
owns your network, and turn the switch on in the menu bar. beafk will not
install, start, or sign into Tailscale.app as a side effect.
- Adding packages is Linux's. The verb uses
apt, so a Mac refuses and names
brew install instead.
- Updates are run there. The panel's update button is offered on Linux
today; on a Mac,
beafk update in a terminal is the same update. See
keeping every machine up to date.
Taking it off
sudo beafk uninstall # drop sudo on a Mac
It tells the cabinet first, then takes beafk off the machine and leaves
everything that was not beafk's. You do not have to disconnect from the panel
beforehand. What exactly stays yours, whether you uninstall or simply stop
paying, is
when a subscription lapses.